EDA Event Stream Subject Header Injection in AAP Gateway

Executive Summary

CVE-2026-12382 is a flaw in the AAP Gateway's Envoy proxy configuration that allows bypassing mutual TLS authentication. The non-mTLS route for EDA event streams fails to remove the Subject HTTP header from client requests, despite being configured to do so. An attacker can inject a spoofed Subject header matching a legitimate client certificate's Distinguished Name to bypass mTLS and inject arbitrary events into protected streams.

Useful 0 Not Useful 0

Detection Guidance

Check if the non-mTLS route /eda-event-streams/ is accessible without client certificate validation. Inspect Envoy proxy configuration for missing requestHeadersToRemove directive for the Subject header. Monitor for POST requests to this route with spoofed Subject headers matching legitimate client certificate DNs.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to bypass authentication and inject malicious events into EDA streams, potentially triggering unauthorized automation actions on managed infrastructure. This could lead to unauthorized access, data breaches, or system compromises depending on the downstream rulebook actions.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access and data manipulation, violating confidentiality and integrity requirements in GDPR and HIPAA. Compliance may be impacted if the affected system processes sensitive data, as it undermines secure authentication and event integrity controls.

Useful 0 Not Useful 0

Mitigation Strategies

Disable the non-mTLS route /eda-event-streams/ if not required. Ensure the requestHeadersToRemove directive for the Subject header is properly configured in the Envoy xDS configuration. Restrict access to the mTLS route /mtls/eda-event-streams/ and validate all client certificates strictly.

Useful 0 Not Useful 0