Every CVE Search/ Get API key

CVE-2026-12382

Aap-gateway: missing requestheaderstoremove allows mtls bypass via subject header spoofing

8.2 High

A flaw was found in the AAP Gateway Envoy proxy configuration. The non-mTLS route to EDA event streams does not remove the Subject HTTP header from client requests, despite the source code defining requestHeadersToRemove for this header. An unauthenticated remote attacker can inject a spoofed Subject header matching a legitimate client certificate DN to bypass mTLS authentication and inject arbitrary events into protected EDA event streams.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
High
Availability
None

Exploit likelihood

0.46%Up 0.1 points since Jul 16, 2026
90%50%10%1%

What each source reports

CVE List Score used 8.2

Aap-gateway: missing requestheaderstoremove allows mtls bypass via subject header spoofing

A flaw was found in the AAP Gateway Envoy proxy configuration. The non-mTLS route to EDA event streams does not remove the Subject HTTP header from client requests, despite the source code defining requestHeadersToRemove for this header. An unauthenticated remote attacker can inject a spoofed Subject header matching a legitimate client certificate DN to bypass mTLS authentication and inject arbitrary events into protected EDA event streams.

Record
CVE-2026-12382
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Weakness
CWE-290
Updated
2026-11-02
EUVDEUVD-2026-44739 8.2

A flaw was found in the AAP Gateway Envoy proxy configuration. The non-mTLS route to EDA event streams does not remove the Subject HTTP header from client requests, despite the source code defining requestHeadersToRemove for this header. An unauthenticated remote attacker can inject a spoofed Subject header matching a legitimate client certificate DN to bypass mTLS authentication and inject arbitrary events into protected EDA event streams.

Record
EUVD-2026-44739
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-45w6-c976-v24q 8.2

A flaw was found in the AAP Gateway Envoy proxy configuration. The non-mTLS route to EDA event...

A flaw was found in the AAP Gateway Envoy proxy configuration. The non-mTLS route to EDA event streams does not remove the Subject HTTP header from client requests, despite the source code defining requestHeadersToRemove for this header. An unauthenticated remote attacker can inject a spoofed Subject header matching a legitimate client certificate DN to bypass mTLS authentication and inject arbitrary events into protected EDA event streams.

Record
GHSA-45w6-c976-v24q
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Weakness
CWE-290
Updated
2026-11-02
NVD 8.2

A flaw was found in the AAP Gateway Envoy proxy configuration. The non-mTLS route to EDA event streams does not remove the Subject HTTP header from client requests, despite the source code defining requestHeadersToRemove for this header. An unauthenticated remote attacker can inject a spoofed Subject header matching a legitimate client certificate DN to bypass mTLS authentication and inject arbitrary events into protected EDA event streams.

Record
CVE-2026-12382
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Weakness
CWE-290
Updated
2026-11-02
OSVRHSA-2026:13508 9.1

Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update

Record
RHSA-2026:13508
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:42078 9.0

Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update

Record
RHSA-2026:42078
CVSS 3.1
9.0 CriticalCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
automation-controller
Red Hat:ansible_automation_platform_developer:2.6::el9
From an advisory covering 12 CVEs
 before 0:4.7.11-2.el9ap
0:4.7.11-2.el9ap
automation-controller-cli
Red Hat:ansible_automation_platform_developer:2.6::el9
From an advisory covering 12 CVEs
 before 0:4.7.11-2.el9ap
0:4.7.11-2.el9ap
automation-controller
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
 before 0:4.7.11-2.el9ap
0:4.7.11-2.el9ap
automation-controller-cli
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
 before 0:4.7.11-2.el9ap
0:4.7.11-2.el9ap
automation-controller-server
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
 before 0:4.7.11-2.el9ap
0:4.7.11-2.el9ap
automation-controller-ui
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
 before 0:4.7.11-2.el9ap
0:4.7.11-2.el9ap
automation-controller-venv-tower
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
 before 0:4.7.11-2.el9ap
0:4.7.11-2.el9ap
python3.12-markdown
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
 before 0:3.10.2-1.el9ap
0:3.10.2-1.el9ap
automation-gateway-server
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
 before 0:2.6.20260422-1.el9ap
0:2.6.20260422-1.el9ap
python3.12-django-ansible-base+activitystream
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
 before 0:2.6.20260422-1.el9ap
0:2.6.20260422-1.el9ap
Show 112 moreShow less
Affected packages
PackageAffectedFixed
python3.12-django-ansible-base+api_documentation
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
 before 0:2.6.20260422-1.el9ap
0:2.6.20260422-1.el9ap
python3.12-django-ansible-base+authentication
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
 before 0:2.6.20260422-1.el9ap
0:2.6.20260422-1.el9ap
python3.12-django-ansible-base+channel_auth
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
 before 0:2.6.20260422-1.el9ap
0:2.6.20260422-1.el9ap
python3.12-django-ansible-base+feature_flags
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
 before 0:2.6.20260422-1.el9ap
0:2.6.20260422-1.el9ap
python3.12-django-ansible-base+jwt_consumer
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
 before 0:2.6.20260422-1.el9ap
0:2.6.20260422-1.el9ap
python3.12-django-ansible-base+oauth2_provider
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
 before 0:2.6.20260422-1.el9ap
0:2.6.20260422-1.el9ap
python3.12-django-ansible-base+rbac
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
 before 0:2.6.20260422-1.el9ap
0:2.6.20260422-1.el9ap
python3.12-django-ansible-base+redis_client
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
 before 0:2.6.20260422-1.el9ap
0:2.6.20260422-1.el9ap
python3.12-django-ansible-base+resource_registry
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
 before 0:2.6.20260422-1.el9ap
0:2.6.20260422-1.el9ap
python3.12-django-ansible-base+rest_filters
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
 before 0:2.6.20260422-1.el9ap
0:2.6.20260422-1.el9ap
python3.12-django-ansible-base
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
 before 0:2.6.20260422-1.el9ap
0:2.6.20260422-1.el9ap
python3.12-pyasn1
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
 before 0:0.6.3-1.el9ap
0:0.6.3-1.el9ap
receptor
Red Hat:ansible_automation_platform:2.6::el10
From an advisory covering 12 CVEs
 before 0:1.6.4-3.el10ap
0:1.6.4-3.el10ap
receptor-debuginfo
Red Hat:ansible_automation_platform:2.6::el10
From an advisory covering 12 CVEs
 before 0:1.6.4-3.el10ap
0:1.6.4-3.el10ap
receptor-debugsource
Red Hat:ansible_automation_platform:2.6::el10
From an advisory covering 12 CVEs
 before 0:1.6.4-3.el10ap
0:1.6.4-3.el10ap
receptorctl
Red Hat:ansible_automation_platform:2.6::el10
From an advisory covering 12 CVEs
 before 0:1.6.4-3.el10ap
0:1.6.4-3.el10ap
receptor
Red Hat:ansible_automation_platform_developer:2.6::el9
From an advisory covering 12 CVEs
 before 0:1.6.4-2.el9ap
0:1.6.4-2.el9ap
receptorctl
Red Hat:ansible_automation_platform_developer:2.6::el9
From an advisory covering 12 CVEs
 before 0:1.6.4-2.el9ap
0:1.6.4-2.el9ap
receptor
Red Hat:ansible_automation_platform_inside:2.6::el9
From an advisory covering 12 CVEs
 before 0:1.6.4-2.el9ap
0:1.6.4-2.el9ap
receptorctl
Red Hat:ansible_automation_platform_inside:2.6::el9
From an advisory covering 12 CVEs
 before 0:1.6.4-2.el9ap
0:1.6.4-2.el9ap
automation-gateway-proxy-debugsource
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
 before 0:2.6.14-2.el9
0:2.6.14-2.el9
automation-gateway-proxy-server
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
 before 0:2.6.14-2.el9
0:2.6.14-2.el9
automation-gateway-proxy-server-debuginfo
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
 before 0:2.6.14-2.el9
0:2.6.14-2.el9
receptor
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
 before 0:1.6.4-2.el9ap
0:1.6.4-2.el9ap
receptor-debuginfo
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
 before 0:1.6.4-2.el9ap
0:1.6.4-2.el9ap
receptor-debugsource
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
 before 0:1.6.4-2.el9ap
0:1.6.4-2.el9ap
receptorctl
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
 before 0:1.6.4-2.el9ap
0:1.6.4-2.el9ap
automation-platform-ui
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
 before 0:2.6.8-1.el9ap
0:2.6.8-1.el9ap
python3.12-pyOpenSSL
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
 before 0:26.0.0-1.el9ap
0:26.0.0-1.el9ap
python3.12-pyjwt+crypto
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
 before 0:2.12.1-1.el9ap
0:2.12.1-1.el9ap
python3.12-pyjwt
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
 before 0:2.12.1-1.el9ap
0:2.12.1-1.el9ap
python3.12-jwcrypto
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
 before 0:1.5.7-1.el9ap
0:1.5.7-1.el9ap
automation-gateway-server
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 25 CVEs
 before 0:2.5.20260715-1.el8ap
0:2.5.20260715-1.el8ap
automation-gateway-server
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 25 CVEs
 before 0:2.5.20260715-1.el9ap
0:2.5.20260715-1.el9ap
automation-controller-venv-tower
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 25 CVEs
 before 0:4.6.30-2.el8ap
0:4.6.30-2.el8ap
automation-controller-venv-tower
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 25 CVEs
 before 0:4.6.30-2.el9ap
0:4.6.30-2.el9ap
ansible-core
Red Hat:ansible_automation_platform_developer:2.5::el8
From an advisory covering 25 CVEs
 before 1:2.16.19-1.el8ap
1:2.16.19-1.el8ap
ansible-core
Red Hat:ansible_automation_platform_inside:2.5::el8
From an advisory covering 25 CVEs
 before 1:2.16.19-1.el8ap
1:2.16.19-1.el8ap
ansible-core
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 25 CVEs
 before 1:2.16.19-1.el8ap
1:2.16.19-1.el8ap
ansible-core
Red Hat:ansible_automation_platform_developer:2.5::el9
From an advisory covering 25 CVEs
 before 1:2.16.19-1.el9ap
1:2.16.19-1.el9ap
ansible-core
Red Hat:ansible_automation_platform_inside:2.5::el9
From an advisory covering 25 CVEs
 before 1:2.16.19-1.el9ap
1:2.16.19-1.el9ap
ansible-core
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 25 CVEs
 before 1:2.16.19-1.el9ap
1:2.16.19-1.el9ap
python3.12-pulpcore
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 25 CVEs
 before 0:3.49.63-2.el8ap
0:3.49.63-2.el8ap
python3.12-pulpcore
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 25 CVEs
 before 0:3.49.63-2.el9ap
0:3.49.63-2.el9ap
receptor
Red Hat:ansible_automation_platform_developer:2.5::el8
From an advisory covering 25 CVEs
 before 0:1.6.6-1.el8ap
0:1.6.6-1.el8ap
receptor
Red Hat:ansible_automation_platform_inside:2.5::el8
From an advisory covering 25 CVEs
 before 0:1.6.6-1.el8ap
0:1.6.6-1.el8ap
receptor
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 25 CVEs
 before 0:1.6.6-1.el8ap
0:1.6.6-1.el8ap
receptor
Red Hat:ansible_automation_platform_developer:2.5::el9
From an advisory covering 25 CVEs
 before 0:1.6.6-1.el9ap
0:1.6.6-1.el9ap
receptor
Red Hat:ansible_automation_platform_inside:2.5::el9
From an advisory covering 25 CVEs
 before 0:1.6.6-1.el9ap
0:1.6.6-1.el9ap
receptor
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 25 CVEs
 before 0:1.6.6-1.el9ap
0:1.6.6-1.el9ap
receptorctl
Red Hat:ansible_automation_platform_developer:2.5::el8
From an advisory covering 25 CVEs
 before 0:1.6.6-1.el8ap
0:1.6.6-1.el8ap
receptorctl
Red Hat:ansible_automation_platform_inside:2.5::el8
From an advisory covering 25 CVEs
 before 0:1.6.6-1.el8ap
0:1.6.6-1.el8ap
receptor-debuginfo
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 25 CVEs
 before 0:1.6.6-1.el8ap
0:1.6.6-1.el8ap
receptor-debugsource
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 25 CVEs
 before 0:1.6.6-1.el8ap
0:1.6.6-1.el8ap
receptorctl
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 25 CVEs
 before 0:1.6.6-1.el8ap
0:1.6.6-1.el8ap
receptorctl
Red Hat:ansible_automation_platform_developer:2.5::el9
From an advisory covering 25 CVEs
 before 0:1.6.6-1.el9ap
0:1.6.6-1.el9ap
receptorctl
Red Hat:ansible_automation_platform_inside:2.5::el9
From an advisory covering 25 CVEs
 before 0:1.6.6-1.el9ap
0:1.6.6-1.el9ap
receptor-debuginfo
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 25 CVEs
 before 0:1.6.6-1.el9ap
0:1.6.6-1.el9ap
receptor-debugsource
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 25 CVEs
 before 0:1.6.6-1.el9ap
0:1.6.6-1.el9ap
receptorctl
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 25 CVEs
 before 0:1.6.6-1.el9ap
0:1.6.6-1.el9ap
python3.12-gitpython
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 25 CVEs
 before 0:3.1.50-1.el8ap
0:3.1.50-1.el8ap
python3.12-gitpython
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 25 CVEs
 before 0:3.1.50-1.el9ap
0:3.1.50-1.el9ap
automation-controller
Red Hat:ansible_automation_platform_developer:2.5::el8
From an advisory covering 25 CVEs
 before 0:4.6.30-2.el8ap
0:4.6.30-2.el8ap
automation-controller-cli
Red Hat:ansible_automation_platform_developer:2.5::el8
From an advisory covering 25 CVEs
 before 0:4.6.30-2.el8ap
0:4.6.30-2.el8ap
python3.12-urllib3
Red Hat:ansible_automation_platform_developer:2.5::el8
From an advisory covering 25 CVEs
 before 0:2.7.0-1.el8ap
0:2.7.0-1.el8ap
ansible-test
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 25 CVEs
 before 1:2.16.19-1.el8ap
1:2.16.19-1.el8ap
automation-controller
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 25 CVEs
 before 0:4.6.30-2.el8ap
0:4.6.30-2.el8ap
automation-controller-cli
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 25 CVEs
 before 0:4.6.30-2.el8ap
0:4.6.30-2.el8ap
automation-controller-server
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 25 CVEs
 before 0:4.6.30-2.el8ap
0:4.6.30-2.el8ap
automation-controller-ui
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 25 CVEs
 before 0:4.6.30-2.el8ap
0:4.6.30-2.el8ap
automation-eda-controller
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 25 CVEs
 before 0:1.1.20-1.el8ap
0:1.1.20-1.el8ap
automation-eda-controller-base
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 25 CVEs
 before 0:1.1.20-1.el8ap
0:1.1.20-1.el8ap
automation-eda-controller-base-services
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 25 CVEs
 before 0:1.1.20-1.el8ap
0:1.1.20-1.el8ap
automation-eda-controller-event-stream-services
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 25 CVEs
 before 0:1.1.20-1.el8ap
0:1.1.20-1.el8ap
automation-eda-controller-worker-services
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 25 CVEs
 before 0:1.1.20-1.el8ap
0:1.1.20-1.el8ap
automation-gateway
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 25 CVEs
 before 0:2.5.20260715-1.el8ap
0:2.5.20260715-1.el8ap
automation-gateway-config
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 25 CVEs
 before 0:2.5.20260715-1.el8ap
0:2.5.20260715-1.el8ap
automation-hub
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 25 CVEs
 before 0:4.10.16-1.el8ap
0:4.10.16-1.el8ap
python3.12-galaxy-ng
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 25 CVEs
 before 0:4.10.16-1.el8ap
0:4.10.16-1.el8ap
python3.12-pulp-ansible
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 25 CVEs
 before 1:0.25.6-1.el8ap
1:0.25.6-1.el8ap
python3.12-pulp-container
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 25 CVEs
 before 0:2.19.12-1.el8ap
0:2.19.12-1.el8ap
python3.12-pyjwt+crypto
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 25 CVEs
 before 0:2.13.0-1.el8ap
0:2.13.0-1.el8ap
python3.12-pyjwt
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 25 CVEs
 before 0:2.13.0-1.el8ap
0:2.13.0-1.el8ap
python3.12-pysequoia
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 25 CVEs
 before 0:0.1.34-1.el8ap
0:0.1.34-1.el8ap
python3.12-pysequoia-debuginfo
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 25 CVEs
 before 0:0.1.34-1.el8ap
0:0.1.34-1.el8ap
python3.12-pysequoia-debugsource
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 25 CVEs
 before 0:0.1.34-1.el8ap
0:0.1.34-1.el8ap
python3.12-urllib3
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 25 CVEs
 before 0:2.7.0-1.el8ap
0:2.7.0-1.el8ap
automation-controller
Red Hat:ansible_automation_platform_developer:2.5::el9
From an advisory covering 25 CVEs
 before 0:4.6.30-2.el9ap
0:4.6.30-2.el9ap
automation-controller-cli
Red Hat:ansible_automation_platform_developer:2.5::el9
From an advisory covering 25 CVEs
 before 0:4.6.30-2.el9ap
0:4.6.30-2.el9ap
python3.12-urllib3
Red Hat:ansible_automation_platform_developer:2.5::el9
From an advisory covering 25 CVEs
 before 0:2.7.0-1.el9ap
0:2.7.0-1.el9ap
ansible-test
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 25 CVEs
 before 1:2.16.19-1.el9ap
1:2.16.19-1.el9ap
automation-controller
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 25 CVEs
 before 0:4.6.30-2.el9ap
0:4.6.30-2.el9ap
automation-controller-cli
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 25 CVEs
 before 0:4.6.30-2.el9ap
0:4.6.30-2.el9ap
automation-controller-server
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 25 CVEs
 before 0:4.6.30-2.el9ap
0:4.6.30-2.el9ap
automation-controller-ui
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 25 CVEs
 before 0:4.6.30-2.el9ap
0:4.6.30-2.el9ap
automation-eda-controller
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 25 CVEs
 before 0:1.1.20-1.el9ap
0:1.1.20-1.el9ap
automation-eda-controller-base
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 25 CVEs
 before 0:1.1.20-1.el9ap
0:1.1.20-1.el9ap
automation-eda-controller-base-services
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 25 CVEs
 before 0:1.1.20-1.el9ap
0:1.1.20-1.el9ap
automation-eda-controller-event-stream-services
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 25 CVEs
 before 0:1.1.20-1.el9ap
0:1.1.20-1.el9ap
automation-eda-controller-worker-services
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 25 CVEs
 before 0:1.1.20-1.el9ap
0:1.1.20-1.el9ap
automation-gateway
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 25 CVEs
 before 0:2.5.20260715-1.el9ap
0:2.5.20260715-1.el9ap
automation-gateway-config
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 25 CVEs
 before 0:2.5.20260715-1.el9ap
0:2.5.20260715-1.el9ap
automation-hub
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 25 CVEs
 before 0:4.10.16-1.el9ap
0:4.10.16-1.el9ap
python3.12-galaxy-ng
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 25 CVEs
 before 0:4.10.16-1.el9ap
0:4.10.16-1.el9ap
python3.12-pulp-ansible
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 25 CVEs
 before 1:0.25.6-1.el9ap
1:0.25.6-1.el9ap
python3.12-pulp-container
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 25 CVEs
 before 0:2.19.12-1.el9ap
0:2.19.12-1.el9ap
python3.12-pyjwt+crypto
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 25 CVEs
 before 0:2.13.0-1.el9ap
0:2.13.0-1.el9ap
python3.12-pyjwt
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 25 CVEs
 before 0:2.13.0-1.el9ap
0:2.13.0-1.el9ap
python3.12-pysequoia
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 25 CVEs
 before 0:0.1.34-1.el9ap
0:0.1.34-1.el9ap
python3.12-pysequoia-debuginfo
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 25 CVEs
 before 0:0.1.34-1.el9ap
0:0.1.34-1.el9ap
python3.12-pysequoia-debugsource
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 25 CVEs
 before 0:0.1.34-1.el9ap
0:0.1.34-1.el9ap
python3.12-urllib3
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 25 CVEs
 before 0:2.7.0-1.el9ap
0:2.7.0-1.el9ap

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-12382 is a high vulnerability (CVSS 8.2) in Red Hat Ansible Automation Platform 2.5 For Rhel 8, published May 5, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.46%, the 40th percentile. No source names a fixed version.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 23 references. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open