CVE-2026-18141: Aap-gateway: aap-gateway: authentication bypass in event-driven ansible via forged http header

Awaiting analysis

Published 31-07-2026Last modified 04-08-2026

Vulnerability summary

CVE-2026-18141 is a high (CVSS 8.2) Improper Certificate Validation vulnerability. EPSS estimates a 0.43% chance of exploitation in the next 30 days, higher than 37% of scored vulnerabilities.

Priority

Prioritisesevere

Severe, CVSS 8.2 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 0% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?

CVSS score

8.2/10

010

High · v3.1 (CVE.org)

EPSS score

0.43%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 1

RHSA-2026:50336

Timeline

31-07-2026
PublishedVulnerability first disclosed.
04-08-2026
Last modifiedVulnerability information updated.

Description

A flaw was found in aap-gateway, a component of Ansible Automation Platform's Event-Driven Ansible (EDA). An unauthenticated remote attacker can bypass mutual Transport Layer Security (mTLS) authentication for event streams. This is achieved by manipulating the event stream URL and forging the HTTP Subject header. The system also inadvertently discloses the expected certificate subject in error messages, which simplifies the attack. This vulnerability allows an attacker to inject arbitrary events into EDA, potentially triggering automated workflows.