CVE-2026-12383 Eda-server: externaleventstreamviewset trusts subject header without validation and leaks expected dn
Attackers can bypass mTLS authentication by spoofing the Subject header to inject arbitrary events into Ansible EDA streams, triggering unauthorized automation actions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-12383?
CVE-2026-12383 is a high-severity authentication bypass vulnerability in Red Hat Ansible Automation Platform 2.5 for RHEL 8, published on 27 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in the Event-Driven Ansible (EDA) server. The ExternalEventStreamViewSet uses permissive access controls (permission_classes=[AllowAny], authentication_classes=[]) and relies solely on the Subject HTTP header value for mTLS authentication without verifying that the header originated from a trusted proxy. Additionally, the expected certificate Distinguished Name is leaked in the 403 error response body. An attacker who can reach the EDA API endpoint with a spoofed Subject header can inject arbitrary events into mTLS-protected event streams, triggering downstream automation actions.
Weakness: CWE-345
Which versions are affected by CVE-2026-12383?
How do I fix CVE-2026-12383?
Apply the vendor's patch.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-12383 being exploited?
There is no known exploitation of CVE-2026-12383 in the wild and no public exploit code.
Sources
Also known as GHSA-c4xf-fv75-hwxm.