{"id":"CVE-2026-11807","aliases":["EUVD-2026-38598","GHSA-3w6r-r33r-cfg6","RHSA-2026:28376","RHSA-2026:28377"],"status":"published","title":"Eda-server: websocket missing authorization allows credential theft via activation_id spoofing","description":"A missing authorization vulnerability was found in the Event-Driven Ansible (EDA) websocket API. The /api/eda/ws/ansible-rulebook endpoint does not verify user permissions when processing Worker messages. Any authenticated user can send a forged message with an arbitrary activation_id to receive plaintext credentials associated with that activation, including OAuth tokens, vault passwords, and SSH keys.","severity":{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00531,"percentile":0.45214,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-862"],"published":"2026-06-23T19:40:33Z","modified":"2026-11-04T21:51:08Z","fixes":[{"ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-eda-controller","fixed_in":["0:1.1.19-1.el8ap"],"sources":["osv"]},{"ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-eda-controller-base","fixed_in":["0:1.1.19-1.el8ap"],"sources":["osv"]},{"ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-eda-controller-base-services","fixed_in":["0:1.1.19-1.el8ap"],"sources":["osv"]},{"ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-eda-controller-event-stream-services","fixed_in":["0:1.1.19-1.el8ap"],"sources":["osv"]},{"ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-eda-controller-worker-services","fixed_in":["0:1.1.19-1.el8ap"],"sources":["osv"]},{"ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-eda-controller","fixed_in":["0:1.1.19-1.el9ap"],"sources":["osv"]},{"ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-eda-controller-base","fixed_in":["0:1.1.19-1.el9ap"],"sources":["osv"]},{"ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-eda-controller-base-services","fixed_in":["0:1.1.19-1.el9ap"],"sources":["osv"]},{"ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-eda-controller-event-stream-services","fixed_in":["0:1.1.19-1.el9ap"],"sources":["osv"]},{"ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-eda-controller-worker-services","fixed_in":["0:1.1.19-1.el9ap"],"sources":["osv"]},{"ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-eda-controller","fixed_in":["0:1.2.9-2.el9ap"],"sources":["osv"]},{"ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-eda-controller-base","fixed_in":["0:1.2.9-2.el9ap"],"sources":["osv"]},{"ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-eda-controller-base-services","fixed_in":["0:1.2.9-2.el9ap"],"sources":["osv"]},{"ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-eda-controller-event-stream-services","fixed_in":["0:1.2.9-2.el9ap"],"sources":["osv"]},{"ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-eda-controller-worker-services","fixed_in":["0:1.2.9-2.el9ap"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-eda-controller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.19-1.el8ap"}]}]},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-eda-controller-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.19-1.el8ap"}]}]},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-eda-controller-base-services","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.19-1.el8ap"}]}]},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-eda-controller-event-stream-services","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.19-1.el8ap"}]}]},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-eda-controller-worker-services","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.19-1.el8ap"}]}]},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-eda-controller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.19-1.el9ap"}]}]},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-eda-controller-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.19-1.el9ap"}]}]},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-eda-controller-base-services","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.19-1.el9ap"}]}]},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-eda-controller-event-stream-services","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.19-1.el9ap"}]}]},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-eda-controller-worker-services","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.19-1.el9ap"}]}]},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-eda-controller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.9-2.el9ap"}]}]},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-eda-controller-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.9-2.el9ap"}]}]},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-eda-controller-base-services","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.9-2.el9ap"}]}]},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-eda-controller-event-stream-services","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.9-2.el9ap"}]}]},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-eda-controller-worker-services","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.9-2.el9ap"}]}]}],"products":[{"vendor":"red hat","product":"red hat ansible automation platform 2"},{"vendor":"red hat","product":"red hat ansible automation platform 2.5"},{"vendor":"red hat","product":"red hat ansible automation platform 2.5 for rhel 8"},{"vendor":"red hat","product":"red hat ansible automation platform 2.5 for rhel 9"},{"vendor":"red hat","product":"red hat ansible automation platform 2.6"},{"vendor":"red hat","product":"red hat ansible automation platform 2.6 for rhel 9"},{"vendor":"red hat","product":"red hat ansible automation platform 2.7"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:28376","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:28377","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:28440","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:28492","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:28497","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-11807","tags":["vdb-entry","x_refsource_REDHAT","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2487036","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11807.json","tags":["x_sadp-csaf-vex"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11807","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-3w6r-r33r-cfg6"},{"url":"https://access.redhat.com/security/updates/classification/#critical","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_28376.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-11807","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_28377.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-11807","title":"Eda-server: websocket missing authorization allows credential theft via activation_id spoofing","description":"A missing authorization vulnerability was found in the Event-Driven Ansible (EDA) websocket API. The /api/eda/ws/ansible-rulebook endpoint does not verify user permissions when processing Worker messages. Any authenticated user can send a forged message with an arbitrary activation_id to receive plaintext credentials associated with that activation, including OAuth tokens, vault passwords, and SSH keys.","status":"published","published":"2026-06-23T19:40:33.182Z","modified":"2026-11-04T21:51:08.848Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","level":"critical","assessor":"cna"},{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","level":"critical","assessor":"adp"}],"cwes":["CWE-862","CWE-862"],"updated_at":"2026-11-04T22:39:15.65538Z"}],"euvd":[{"id":"EUVD-2026-38598","description":"A missing authorization vulnerability was found in the Event-Driven Ansible (EDA) websocket API. The /api/eda/ws/ansible-rulebook endpoint does not verify user permissions when processing Worker messages. Any authenticated user can send a forged message with an arbitrary activation_id to receive plaintext credentials associated with that activation, including OAuth tokens, vault passwords, and SSH keys.","status":"published","published":"2026-06-23T19:40:33Z","modified":"2026-11-04T21:51:08Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-04T23:47:19.24864Z"}],"ghsa":[{"id":"GHSA-3w6r-r33r-cfg6","title":"A missing authorization vulnerability was found in the Event-Driven Ansible (EDA) websocket API....","description":"A missing authorization vulnerability was found in the Event-Driven Ansible (EDA) websocket API. The /api/eda/ws/ansible-rulebook endpoint does not verify user permissions when processing Worker messages. Any authenticated user can send a forged message with an arbitrary activation_id to receive plaintext credentials associated with that activation, including OAuth tokens, vault passwords, and SSH keys.","status":"published","published":"2026-06-23T21:30:31Z","modified":"2026-07-15T15:33:48Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:09:33.182129Z"}],"nvd":[{"id":"CVE-2026-11807","description":"A missing authorization vulnerability was found in the Event-Driven Ansible (EDA) websocket API. The /api/eda/ws/ansible-rulebook endpoint does not verify user permissions when processing Worker messages. Any authenticated user can send a forged message with an arbitrary activation_id to receive plaintext credentials associated with that activation, including OAuth tokens, vault passwords, and SSH keys.","status":"published","published":"2026-06-23T21:16:54.35Z","modified":"2026-11-04T22:17:52.96Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","level":"critical","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-04T23:43:39.147797Z"}],"osv":[{"id":"RHSA-2026:28376","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security Update","status":"published","published":"2026-06-24T10:08:38Z","modified":"2026-07-16T10:07:38Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:53:19.449341Z"},{"id":"RHSA-2026:28377","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security Update","status":"published","published":"2026-06-24T10:08:38Z","modified":"2026-07-16T10:07:38Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:53:19.449341Z"}]}}