Critical Event-Driven Ansible Flaw Leaks Stored Credentials

Red Hat has recently announced a critical security vulnerability, CVE-2026-11807, affecting its Event-Driven Ansible (EDA) component, which is part of the Red Hat Ansible Automation Platform. This flaw has been assigned a CVSS score of 9.6, indicating its high severity and potential for significant impact. The core of the issue lies within the Event-Driven Ansible websocket API, where a critical authorization check is missing. The vulnerability allows any authenticated user, regardless of their specific permissions, to exploit the system. By crafting a malicious request and supplying an arbitrary activation ID, an attacker can bypass the authorization mechanisms. This enables them to retrieve plaintext credentials that they should not have access to. These exposed credentials can include highly sensitive information such as OAuth tokens, vault passwords, and SSH keys. The implications of this credential disclosure are substantial. Event-Driven Ansible is designed to automate responses across various IT systems, often requiring access to powerful secrets to perform its functions. If an attacker gains access to these credentials, they could potentially move laterally within the network, gaining unauthorized access to numerous managed hosts or other critical infrastructure components. A single leaked SSH key, for instance, could unlock a wide array of systems, leading to a much broader compromise than just the initial vulnerability. Red Hat has emphasized the urgency of addressing this flaw and has already released security updates to mitigate the risk. Patches are available for Red Hat Ansible Automation Platform versions 2.5 and 2.6. Organizations utilizing Event-Driven Ansible are strongly advised to apply these updates immediately to close the vulnerability. Until patches can be fully deployed, Red Hat recommends restricting network access to the affected websocket endpoint as a temporary protective measure. Additionally, administrators should review and limit the accounts that have authentication privileges to the platform. Following the application of patches, it is crucial to rotate any potentially exposed tokens, passwords, and keys to ensure complete remediation and prevent further exploitation. This incident highlights the ongoing importance of robust security practices in automation platforms, especially those handling sensitive access credentials. The ability of an attacker to gain such privileged information without administrative rights or user interaction underscores the severity and the need for prompt action from affected users.