CVE-2026-18141— Aap-gateway: aap-gateway: authentication bypass in event-driven ansible via forged http header
Possible ATT&CK Techniques 1AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 4
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Red Hat | Red Hat Ansible Automation Platform 2 | any | unaffected |
any | affected | ||
any | affected | ||
any | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-18141
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Aap-gateway: aap-gateway: authentication bypass in event-driven ansible via forged http header
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in aap-gateway, a component of Ansible Automation Platform's Event-Driven Ansible (EDA). An unauthenticated remote attacker can bypass mutual Transport Layer Security (mTLS) authentication for event streams. This is achieved by manipulating the event stream URL and forging the HTTP Subject header. The system also inadvertently discloses the expected certificate subject in error messages, which simplifies the attack. This vulnerability allows an attacker to inject arbitrary events into EDA, potentially triggering automated workflows.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
证书验证不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
Red Hat Ansible Automation Platform 加密问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Red Hat Ansible Automation Platform是美国Red Hat公司的一款信息化产品。 Red Hat Ansible Automation Platform 2版本存在加密问题漏洞，该漏洞源于aap-gateway组件绕过mTLS认证问题，攻击者可通过操纵事件流URL和伪造HTTP Subject头，利用错误消息中泄露的证书主题信息，向EDA注入任意事件，可能触发自动化工作流。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Red Hat | Red Hat Ansible Automation Platform 2 | - | cpe:/a:redhat:ansible_automation_platform:2 | |
| Red Hat | Red Hat Ansible Automation Platform 2 | - | cpe:/a:redhat:ansible_automation_platform:2 | |
| Red Hat | Red Hat Ansible Automation Platform 2 | - | cpe:/a:redhat:ansible_automation_platform:2 | |
| Red Hat | Red Hat Ansible Automation Platform 2 | - | cpe:/a:redhat:ansible_automation_platform:2 |
II. Public POCs for CVE-2026-18141
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-18141
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-18141 (2)
Same Patch Batch · Red Hat · 2026-07-31 · 14 CVEs total
| CVE-2026-10079 | 8.5 HIGH | Stackrox: stackrox: deploy-time policy enforcement and visibility bypass via label injecti |
| CVE-2026-15722 | 7.5 HIGH | 389-ds-base: 389-ds-base: pre-authentication stack buffer overflow in get_ruvelement_from_ |
| CVE-2026-11770 | 7.5 HIGH | 389-ds-base: 389-ds-base: pre-auth ldap filter injection in cleanallruv status check |
| CVE-2026-18215 | 6.8 MEDIUM | Keycloak-services: keycloak-services: microsoft external access-token exchange bypasses co |
| CVE-2026-18214 | 6.8 MEDIUM | Keycloak-services: keycloak-services: google external access-token exchange bypasses hoste |
| CVE-2026-18208 | 6.5 MEDIUM | Keycloak-services: keycloak-services: inactive out-of-audience token introspection leaks s |
| CVE-2026-18203 | 6.5 MEDIUM | Keycloak-services: keycloak-services: group policy extendchildren matches sibling group pa |
| CVE-2026-16105 | 4.9 MEDIUM | Keycloak-services: keycloak-services: missing per-role authorization on rolecontainerresou |
| CVE-2026-18218 | 4.2 MEDIUM | Keycloak-services: keycloak-services: client not-before revocation ignored when realm not- |
| CVE-2026-18211 | 4.2 MEDIUM | Keycloak-services: keycloak-services: secure-client-uris policy bypass via localhost-prefi |
| CVE-2026-18206 | 3.7 LOW | Keycloak-services: keycloak-services: client policy source-host wildcard domain matching b |
| CVE-2026-18217 | 3.4 LOW | Keycloak-services: keycloak-services: saml http-redirect binding response preserves query |
| CVE-2026-18209 | 3.4 LOW | Keycloak-services: keycloak-services: oidc redirect_uri fragment bypass in http parameter |
IV. Related Vulnerabilities
Same product: Red Hat Ansible Automation Platform 2
- CVE-2026-12383
Eda-server: externaleventstreamviewset trusts subject header - CVE-2026-44191
Ansible-lightspeed: visual studio code ansible lightspeed ex - CVE-2026-44187
Ansible-lightspeed: ansible lightspeed extension for visual - CVE-2026-44192
Ansible-lightspeed: ansible lightspeed mcp server: remote co - CVE-2026-44190
Ansible-lightspeed: ansible lightspeed visual studio code ex
Same vendor: Red Hat
- CVE-2026-18477
Tar: tar: toctou in incremental dumpdir 'x' rename handling - CVE-2026-18651
389-ds-base: 389-ds-base: sasl plain bind installs connectio - CVE-2026-18508
Tar: tar: --one-top-level hardlink targets not confined to t - CVE-2026-68742
Sssd: sssd: nss responder out-of-bounds read via unchecked a - CVE-2026-6695
Gimp: gimp: remote code execution via crafted paa file
Same weakness: CWE-295
- CVE-2026-69248
python-cryptography verifier accepts wildcard DNS names allo - CVE-2026-67598
Emlog Pro 2.6.23 TLS Certificate Validation Disabled in ai.p - CVE-2025-9291
Improper Certificate Validation in TP-Link Omada Cloud Commu - CVE-2026-58062
Stapled OCSP response accepted without binding to the checke - CVE-2026-8763
Name Constraints bypass via trailing dot in rfc822Name and U
V. Comments for CVE-2026-18141
No comments yet