CVE-2026-18141 is a security flaw in aap-gateway, a component of the Event-Driven Ansible (EDA) within the Ansible Automation Platform. The vulnerability allows an unauthenticated remote attacker to bypass mutual TLS (mTLS) authentication by manipulating the event stream URL and forging the HTTP Subject header. Additionally, the system discloses the expected certificate subject in error messages, which aids attackers in crafting the exploit. Successful exploitation permits injection of arbitrary events into EDA, which may trigger automated workflows without proper authentication.

The vulnerability compromises the integrity of the Event-Driven Ansible system by allowing unauthenticated attackers to inject arbitrary events. This can lead to unauthorized triggering of automated workflows, potentially causing unintended actions or disruptions. Confidentiality impact is low due to limited information disclosure, but integrity impact is high. Availability is not affected.

No explicit patch or remediation is confirmed in the provided vendor advisory content. Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-18141 for current remediation guidance. Until an official fix is available, consider restricting access to the aap-gateway component and monitoring for unusual event stream activity.