The vulnerability in aap-gateway of Red Hat Ansible Automation Platform 2's Event-Driven Ansible (EDA) allows unauthenticated remote attackers to bypass mutual TLS authentication for event streams. Attackers achieve this by manipulating the event stream URL and forging the HTTP Subject header. Additionally, error messages disclose the expected certificate subject, simplifying the attack. Successful exploitation permits injection of arbitrary events into EDA, which can trigger automated workflows. The CVSS 3.1 base score is 8.2, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, low confidentiality impact, high integrity impact, and no availability impact. No patch or official remediation level is currently stated in the vendor advisory. The vendor advisory is available at https://access.redhat.com/security/cve/CVE-2026-18141.

An unauthenticated attacker can bypass mutual TLS authentication and inject arbitrary events into the Event-Driven Ansible component, potentially triggering automated workflows without authorization. This compromises the integrity of the event stream and may lead to unauthorized execution of automated tasks. Confidentiality impact is low, and availability is not affected.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-18141 for current remediation guidance. No official fix or temporary workaround is stated in the advisory content provided. Until a patch is available, consider restricting network access to the aap-gateway component and monitoring for anomalous event stream activity as a precaution.