The vulnerability arises from the AAP Gateway Envoy proxy not removing the Subject HTTP header from client requests on non-mTLS routes to EDA event streams, despite the source code specifying that this header should be removed. An attacker can exploit this by injecting a spoofed Subject header that matches a legitimate client certificate distinguished name (DN), thereby bypassing mutual TLS authentication and injecting arbitrary events into protected event streams within Red Hat Ansible Automation Platform 2.

An unauthenticated remote attacker can bypass mTLS authentication and inject arbitrary events into protected EDA event streams. This compromises the integrity of event streams by allowing unauthorized event injection, potentially leading to unauthorized actions or disruption of automation workflows. Confidentiality impact is low, integrity impact is high, and availability is not affected.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-12382 for current remediation guidance. No official fix or workaround is stated in the provided data. Until a patch is available, restrict access to the affected EDA event streams and monitor for suspicious activity related to event injection attempts.