The vulnerability in Red Hat Ansible Automation Platform's Event-Driven Ansible (EDA) server involves insufficient verification of data authenticity. Specifically, the ExternalEventStreamViewSet component uses permissive access controls (AllowAny) and does not authenticate requests beyond trusting the Subject HTTP header for mTLS authentication. It fails to verify that this header originates from a trusted proxy, and the expected certificate Distinguished Name is disclosed in 403 error responses. An attacker able to spoof the Subject header and access the EDA API endpoint can inject arbitrary events into event streams protected by mTLS, causing unintended downstream automation actions. This issue is a defense-in-depth failure that becomes exploitable in conjunction with a separate gateway header-forwarding vulnerability. The flaw affects all EDA versions supporting external event streams with mTLS authentication, including those in Ansible Automation Platform from version 2.4 onward. Red Hat has released advisories and updates, including for version 2.7, to mitigate this vulnerability.

The vulnerability allows an unauthenticated attacker who can reach the EDA API endpoint to spoof the Subject HTTP header and inject arbitrary events into mTLS-protected event streams. This can trigger unauthorized downstream automation actions, impacting the integrity of the automation platform. Confidentiality and availability are not affected. The flaw also leaks the expected certificate Distinguished Name in error responses, which lowers the difficulty of exploitation. The overall impact is high on integrity but does not affect confidentiality or availability.

Red Hat recommends ensuring that the EDA server is not directly accessible from untrusted networks and that all traffic routes through the Ansible Automation Platform Gateway, which performs proper mTLS validation. Network-level access controls should be configured to restrict source IPs that can reach the EDA backend API. Monitoring EDA event streams for unexpected changes in event counters is advised. If unauthorized access is suspected, mTLS client certificates should be reviewed and rotated due to the potential leakage of the expected Distinguished Name. Red Hat has released updates including for Ansible Automation Platform 2.7 that address this vulnerability. Users should apply these updates and follow the vendor's guidance.