CVE-2026-12383
Awaiting Analysis Awaiting Analysis - Queue

Event Injection in Ansible EDA Server

Publication date: 2026-07-27

Last updated on: 2026-07-27

Assigner: Red Hat, Inc.

Description
A flaw was found in the Event-Driven Ansible (EDA) server. The ExternalEventStreamViewSet uses permissive access controls (permission_classes=[AllowAny], authentication_classes=[]) and relies solely on the Subject HTTP header value for mTLS authentication without verifying that the header originated from a trusted proxy. Additionally, the expected certificate Distinguished Name is leaked in the 403 error response body. An attacker who can reach the EDA API endpoint with a spoofed Subject header can inject arbitrary events into mTLS-protected event streams, triggering downstream automation actions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-27
Last Modified
2026-07-27
Generated
2026-07-28
AI Q&A
2026-07-27
EPSS Evaluated
N/A
NVD
CVE-2026-12383
EUVD
EUVD-2026-49406

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
redhat event_driven_ansible *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-345 The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the Event-Driven Ansible (EDA) server's external event stream handling. The ExternalEventStreamViewSet component uses weak access controls, allowing any Subject HTTP header value without verifying its origin from a trusted proxy. It also leaks the expected certificate Distinguished Name in error responses, helping attackers craft exploits.

Detection Guidance

Check EDA server logs for unusual event stream activity or repeated 403 errors with leaked Distinguished Names. Inspect HTTP headers in requests to the EDA API for spoofed Subject headers. Use network monitoring tools to detect unauthorized access to the EDA API endpoint.

Impact Analysis

An attacker who can reach the EDA API endpoint could spoof the Subject header to inject fake events into protected streams. This could trigger unauthorized automation actions, potentially leading to data breaches, system compromises, or unintended operations in downstream processes.

Compliance Impact

This vulnerability could lead to unauthorized access and data manipulation, violating integrity and confidentiality requirements in GDPR and HIPAA. It undermines secure authentication controls, potentially resulting in non-compliance with data protection and security standards.

Mitigation Strategies

Disable permissive access controls in ExternalEventStreamViewSet by removing AllowAny permission and adding proper authentication. Ensure mTLS validation is enforced independently of HTTP headers. Patch the EDA server to address the header injection flaw and error response leakage.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-12383. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart