CVE-2026-18141 – Red Hat Ansible Automation Platform 2

This update addresses two vulnerabilities affecting Red Hat Ansible Automation Platform 2, specifically the Event-Driven Ansible (EDA) components. CVE-2026-18141 has a CVSS score of 8.2, which is High severity. It allows an unauthenticated remote attacker to bypass mutual TLS (mTLS) authentication by manipulating the event stream URL and forging the HTTP Subject header, potentially injecting arbitrary events into Event-Driven Ansible workflows. CVE-2026-12383 has a CVSS score of 7.5, which is High severity. It stems from overly permissive access controls and reliance on an untrusted Subject HTTP header for authentication, allowing attackers to inject arbitrary events into mTLS-protected event streams. No verified real-world exploitation has been reported for either vulnerability.

The vulnerabilities affect the authentication and authorization mechanisms used by Event-Driven Ansible. Successful exploitation could allow attackers to trigger automated workflows without proper authentication, potentially causing unauthorized actions across managed environments. CVE-2026-18141 has Elevation of Privilege (EoP) characteristics based on the supplied assessment, while CVE-2026-12383 does not have Remote Code Execution (RCE) or Elevation of Privilege (EoP) characteristics. Organizations should apply the latest Red Hat security updates to restore proper authentication validation and secure event processing.