CVE-2026-18141 Aap-gateway: aap-gateway: authentication bypass in event-driven ansible via forged http header
Unauthenticated attackers can bypass mTLS authentication in Ansible Event-Driven Ansible by forging HTTP headers, allowing injection of arbitrary events to trigger workflows.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-18141?
CVE-2026-18141 is a high-severity authentication bypass vulnerability in Red Hat Ansible Automation Platform 2, published on 31 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in aap-gateway, a component of Ansible Automation Platform's Event-Driven Ansible (EDA). An unauthenticated remote attacker can bypass mutual Transport Layer Security (mTLS) authentication for event streams. This is achieved by manipulating the event stream URL and forging the HTTP Subject header. The system also inadvertently discloses the expected certificate subject in error messages, which simplifies the attack. This vulnerability allows an attacker to inject arbitrary events into EDA, potentially triggering automated workflows.
Weakness: CWE-295
Which versions are affected by CVE-2026-18141?
How do I fix CVE-2026-18141?
Apply the vendor's patch.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-18141 being exploited?
There is no known exploitation of CVE-2026-18141 in the wild and no public exploit code.
Sources
Also known as GHSA-9cwv-qxgx-ff4x.