CVE-2026-11807 is a missing authorization vulnerability in the Event-Driven Ansible (EDA) websocket API of Red Hat Ansible Automation Platform. Specifically, the /api/eda/ws/ansible-rulebook endpoint fails to verify user permissions when handling Worker messages. This flaw allows any authenticated user to forge messages with arbitrary activation_id values to retrieve sensitive plaintext credentials associated with those activations, such as OAuth tokens, vault passwords, and SSH keys. The vulnerability affects versions 2.6 through 2.7 of the platform. Red Hat has issued a security advisory (RHSA-2026:28440) with updated container images and recommends applying the update after ensuring all previous errata are applied. Mitigations include restricting network access to the EDA websocket endpoint and limiting user accounts with Ansible Automation Platform authentication until the fix is applied.

An authenticated attacker can exploit this vulnerability to obtain sensitive credentials in plaintext, including OAuth tokens, vault passwords, and SSH keys. This compromises confidentiality and integrity by exposing and potentially allowing modification of critical credentials. The vulnerability has a CVSS v3.1 base score of 9.6 (critical) as assessed by Red Hat, reflecting high impact on confidentiality and integrity with low attack complexity and no user interaction required. There is no known exploitation in the wild at this time.

Red Hat has released an update for Red Hat Ansible Automation Platform 2.7 that addresses this vulnerability. Users should apply this update after ensuring all previously released errata relevant to their system have been applied. Until the update is applied, it is recommended to restrict network access to the EDA websocket endpoint and review and limit user accounts with any level of Ansible Automation Platform authentication to reduce exposure.