CVE-2026-12382: Authentication Bypass by Spoofing in Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8
A flaw was found in the AAP Gateway Envoy proxy configuration. The non-mTLS route to EDA event streams does not remove the Subject HTTP header from client requests, despite the source code defining requestHeadersToRemove for this header. An unauthenticated remote attacker can inject a spoofed Subject header matching a legitimate client certificate DN to bypass mTLS authentication and inject arbitrary events into protected EDA event streams.
AI Analysis
Technical Summary
The vulnerability CVE-2026-12382 affects Red Hat Ansible Automation Platform 2.5 for RHEL 8. It arises from a misconfiguration in the AAP Gateway Envoy proxy where the non-mTLS route to Event-Driven Automation (EDA) event streams does not remove the Subject HTTP header from client requests, despite the source code specifying this header should be removed. This allows an unauthenticated remote attacker to spoof the Subject header to impersonate a legitimate client certificate Distinguished Name (DN), effectively bypassing mutual TLS (mTLS) authentication. This bypass enables the attacker to inject arbitrary events into protected EDA event streams, potentially impacting the integrity of event-driven automation processes. Red Hat has released security updates in version 2.6 of the platform addressing this and other vulnerabilities. The CVSS v3.1 base score is 8.2, indicating high severity with network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, low confidentiality impact, high integrity impact, and no availability impact.
Potential Impact
An unauthenticated remote attacker can bypass mTLS authentication by injecting a spoofed Subject HTTP header that matches a legitimate client certificate DN. This allows the attacker to inject arbitrary events into protected EDA event streams within the Red Hat Ansible Automation Platform. The impact includes potential unauthorized modification of event-driven automation workflows, compromising the integrity of automation processes. Confidentiality impact is rated low, integrity impact is high, and availability is not affected.
Mitigation Recommendations
Red Hat has released an important security update for Red Hat Ansible Automation Platform 2.6 that addresses this vulnerability. Users should upgrade to the fixed version 2.6 as detailed in the Red Hat advisory RHSA-2026:13508 and RHSA-2026:13545. Before applying the update, ensure all previously released errata relevant to your system have been applied. Refer to the official Red Hat Ansible Automation Platform 2.6 documentation for upgrade instructions. Patch status is confirmed as fixed in version 2.6. No additional mitigation steps are indicated by the vendor advisory.
CVE-2026-12382: Authentication Bypass by Spoofing in Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8
Description
A flaw was found in the AAP Gateway Envoy proxy configuration. The non-mTLS route to EDA event streams does not remove the Subject HTTP header from client requests, despite the source code defining requestHeadersToRemove for this header. An unauthenticated remote attacker can inject a spoofed Subject header matching a legitimate client certificate DN to bypass mTLS authentication and inject arbitrary events into protected EDA event streams.
CVSS v3.1
Score 8.2high
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability CVE-2026-12382 affects Red Hat Ansible Automation Platform 2.5 for RHEL 8. It arises from a misconfiguration in the AAP Gateway Envoy proxy where the non-mTLS route to Event-Driven Automation (EDA) event streams does not remove the Subject HTTP header from client requests, despite the source code specifying this header should be removed. This allows an unauthenticated remote attacker to spoof the Subject header to impersonate a legitimate client certificate Distinguished Name (DN), effectively bypassing mutual TLS (mTLS) authentication. This bypass enables the attacker to inject arbitrary events into protected EDA event streams, potentially impacting the integrity of event-driven automation processes. Red Hat has released security updates in version 2.6 of the platform addressing this and other vulnerabilities. The CVSS v3.1 base score is 8.2, indicating high severity with network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, low confidentiality impact, high integrity impact, and no availability impact.
Potential Impact
An unauthenticated remote attacker can bypass mTLS authentication by injecting a spoofed Subject HTTP header that matches a legitimate client certificate DN. This allows the attacker to inject arbitrary events into protected EDA event streams within the Red Hat Ansible Automation Platform. The impact includes potential unauthorized modification of event-driven automation workflows, compromising the integrity of automation processes. Confidentiality impact is rated low, integrity impact is high, and availability is not affected.
Mitigation Recommendations
Red Hat has released an important security update for Red Hat Ansible Automation Platform 2.6 that addresses this vulnerability. Users should upgrade to the fixed version 2.6 as detailed in the Red Hat advisory RHSA-2026:13508 and RHSA-2026:13545. Before applying the update, ensure all previously released errata relevant to your system have been applied. Refer to the official Red Hat Ansible Automation Platform 2.6 documentation for upgrade instructions. Patch status is confirmed as fixed in version 2.6. No additional mitigation steps are indicated by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- redhat
- Date Reserved
- 2026-06-16T10:07:17.206Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-12382","vendor":"Red Hat"}]
Threat ID: 6a57c45368715ace431fb28a
Added to database: 07/15/2026, 17:33:07 UTC
Last enriched: 08/13/2026, 13:33:40 UTC
Last updated: 08/22/2026, 22:52:11 UTC
Views: 110
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.