CVE-2026-12382— Aap-gateway: missing requestheaderstoremove allows mtls bypass via subject header spoofing
Quick assessment
Affected
Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Red Hat Ansible Automation Platform是美国Red Hat公司的一款信息化产品。 Red Hat Ansible Automation Platform存在授权问题漏洞，该漏洞源于AAP Gateway Envoy代理配置问题，非mTLS路由到EDA事件流未移除来自客户端请求的Subject HTTP标头，可能导致未经身份验证的远程攻击者注入伪造的Subject标头，绕过mTLS身份验证并向受保护的EDA事件流注入任意事件。
Possible ATT&CK Techniques 3 AI
T1105 · Ingress Tool Transfer T1190 · Exploit Public-Facing Application T1556.007 · Hybrid IdentityAffected Version Matrix 5
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Red Hat | Red Hat Ansible Automation Platform 2.5 for RHEL 8 | 0:2.5.20260715-1.el8ap< * |
unaffected |
| Red Hat | Red Hat Ansible Automation Platform 2.5 for RHEL 9 | 0:2.5.20260715-1.el9ap< * |
unaffected |
| Red Hat | Red Hat Ansible Automation Platform 2.6 | 1777311120< * |
unaffected |
| Red Hat | Red Hat Ansible Automation Platform 2.6 for RHEL 9 | 0:2.6.20260422-1.el9ap< * |
unaffected |
| Red Hat | Red Hat Ansible Automation Platform 2.7 | 1783919486< * |
unaffected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-12382
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Aap-gateway: missing requestheaderstoremove allows mtls bypass via subject header spoofing
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in the AAP Gateway Envoy proxy configuration. The non-mTLS route to EDA event streams does not remove the Subject HTTP header from client requests, despite the source code defining requestHeadersToRemove for this header. An unauthenticated remote attacker can inject a spoofed Subject header matching a legitimate client certificate DN to bypass mTLS authentication and inject arbitrary events into protected EDA event streams.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
使用欺骗进行的认证绕过
Source: CVE Program / CVE List V5
Vulnerability Title
Red Hat Ansible Automation Platform 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Red Hat Ansible Automation Platform是美国Red Hat公司的一款信息化产品。 Red Hat Ansible Automation Platform存在授权问题漏洞，该漏洞源于AAP Gateway Envoy代理配置问题，非mTLS路由到EDA事件流未移除来自客户端请求的Subject HTTP标头，可能导致未经身份验证的远程攻击者注入伪造的Subject标头，绕过mTLS身份验证并向受保护的EDA事件流注入任意事件。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Red Hat | Red Hat Ansible Automation Platform 2.5 for RHEL 8 | 0:2.5.20260715-1.el8ap ~ * |
cpe:/a:redhat:ansible_automation_platform:2.5::el8
|
|
| Red Hat | Red Hat Ansible Automation Platform 2.5 for RHEL 9 | 0:2.5.20260715-1.el9ap ~ * |
cpe:/a:redhat:ansible_automation_platform:2.5::el8
|
|
| Red Hat | Red Hat Ansible Automation Platform 2.6 for RHEL 9 | 0:2.6.20260422-1.el9ap ~ * |
cpe:/a:redhat:ansible_automation_platform:2.6::el10
|
|
| Red Hat | Red Hat Ansible Automation Platform 2.6 | 1777311120 ~ * |
cpe:/a:redhat:ansible_automation_platform:2.6::el9
|
|
| Red Hat | Red Hat Ansible Automation Platform 2.7 | 1783919486 ~ * |
cpe:/a:redhat:ansible_automation_platform:2.7::el9
|
|
II. Public POCs for CVE-2026-12382
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-12382
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-12382 (6)
-
-
-
🔗 RHSA-2026:42142 - Security Advisory - Red Hat Customer Portal Read full article vendor-advisory x_refsource_REDHAT
-
🔗 RHSA-2026:13545 - Security Advisory - Red Hat Customer Portal Read full article vendor-advisory x_refsource_REDHAT
-
🔗 RHSA-2026:13508 - Security Advisory - Red Hat Customer Portal Read full article vendor-advisory x_refsource_REDHAT
-
🔗 RHSA-2026:42078 - Security Advisory - Red Hat Customer Portal Read full article vendor-advisory x_refsource_REDHAT
Same Patch Batch · Red Hat · 2026-07-15 · 4 CVEs total
| CVE-2026-15809 | 7.8 HIGH | Github.com/cri-o/cri-o: fix bypass for cve-2022-4318 — /etc/passwd injection via home env |
| CVE-2026-14251 | 7.7 HIGH | Gitops-operator: gitops-operator: missing allowednamespace check in reconcilerhook for clu |
| CVE-2026-15779 | 6.1 MEDIUM | Samba-winbind: samba: pam_winbind mkhomedir chowns critical system paths without validatio |
IV. Related Vulnerabilities
Same product: Red Hat Ansible Automation Platform 2.5 for RHEL 8
-
CVE-2026-84724
Automation-controller: automation-controller: systemjob extr -
CVE-2026-84720
Automation-controller: automation-controller: workflowjobnod -
CVE-2026-84718
Automation-controller: automation-controller: client ip spoo -
CVE-2026-84717
Automation-controller: automation-controller: unauthenticate -
CVE-2026-84716
Automation-controller: automation-controller: instance insta
Same vendor: Red Hat
-
CVE-2026-86345
389-ds-base: 389-ds-base: starttls plaintext-buffer retentio -
CVE-2026-86344
389-ds-base: 389-ds-base: unauthenticated worker-thread-pool -
CVE-2026-103884
Keycloak-services: keycloak-services: path traversal in x.50 -
CVE-2026-56098
Rubygem-katello: improper authorization logic allows resourc -
CVE-2026-12545
Rubygem-hammer_cli: command injection via insecure editor in
Same weakness: CWE-290
-
CVE-2026-103347
WordPress hCaptcha for WP plugin <= 5.3.0 - Bypass Vulnerabi -
CVE-2026-103397
OpenSave before 2.4.0-beta.1 Authentication Bypass via Spoof -
CVE-2026-97274
WordPress OAuth Single Sign On – SSO (OAuth Client) plugin < -
CVE-2026-97249
WordPress Paid Member Subscriptions plugin <= 3.0.9 - Bypass -
CVE-2026-96825
WordPress All In One WP Security & Firewall plugin <= 5.4.8
V. Comments for CVE-2026-12382
No comments yet