Executive brief
A security flaw in the Red Hat Ansible Automation Platform (AAP) Gateway allows unauthorized users to bypass identity checks. The gateway, which manages communication for automation tasks, fails to strip certain identity information from incoming requests. This allows an attacker to impersonate a legitimate user and trigger unauthorized automation actions or inject data into protected event streams, potentially leading to unauthorized changes across managed infrastructure.
Technical details
A vulnerability exists in the AAP Gateway Envoy proxy configuration where the 'requestHeadersToRemove' directive for the 'Subject' header is missing from the live xDS configuration, despite being defined in the source code. The gateway provides two routes to Event-Driven Ansible (EDA) event streams: an mTLS-protected route and a non-mTLS route. Because the non-mTLS route fails to strip the 'Subject' header, an unauthenticated remote attacker can inject a spoofed header matching a legitimate client certificate Distinguished Name (DN). This allows the attacker to bypass authentication and inject arbitrary events into protected streams, which can trigger downstream rulebook actions and automation execution. The vulnerability is further exacerbated by the fact that the expected DN may be leaked in 403 error responses.
Affected products
- Red Hat Ansible Automation Platform 2 2.x
Timeline
- 2026-06-16: other: Initial report in Red Hat Bugzilla
- 2026-07-15: disclosed: CVE published to NVD