CVE Intelligence
Analysis AI-assisted

CVE-2026-11807: Red Hat Event-Driven Ansible Missing Authorization in Websocket API

CVE-2026-11807 is a missing authorization flaw in the Event-Driven Ansible websocket endpoint, which does not check user permissions when processing Worker messages. According to the record, an authenticated user can obtain plaintext credentials tied to an arbitrary activation, and the CNA scores it 9.6 under CVSS 3.1. No confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-11807 affects the websocket API of Event-Driven Ansible (EDA). The endpoint /api/eda/ws/ansible-rulebook does not verify user permissions when it processes Worker messages, which corresponds to CWE-862 (Missing Authorization). The CVE was assigned by Red Hat as CNA.

Impact

  • According to the record, any authenticated user can reach plaintext credentials linked to an arbitrary activation.
  • The described credential types include OAuth tokens, vault passwords and SSH keys.
  • The CVSS 3.1 vector reports network attack vector, low privileges required, scope changed, and high confidentiality and integrity impact, with no availability impact.

Affected products and versions

  • The record does not list any affected products or versions.
  • Several Red Hat errata are linked in the references, but the record does not state which product builds or versions they cover.

Exploitation status

  • The record shows no CISA KEV listing. No active exploitation is confirmed in the sources consulted.

Remediation and mitigation

  • Review the linked Red Hat CVE page and the errata referenced there, and apply the updates that match your EDA deployment.
  • Limit which accounts hold authenticated access to EDA until the relevant update is applied.
  • If exposure is suspected, rotate OAuth tokens, vault passwords and SSH keys associated with the affected activations.

Detection guidance

  • Review EDA websocket and API logs for Worker-type messages or activation references coming from accounts that should not have access to them.
  • Periodically audit which accounts can authenticate to EDA and remove access that is not needed.

Limitations of the available information

  • The record has no fixed versions, no affected version list, no EPSS or SSVC data, and no vendor-independent exploitation evidence.
  • The 9.6 score is reported by the CNA and by one other provider; the record does not describe the analysis behind it.
  • The record has no English title, so the title shown here is a derived summary.

Frequently asked questions

What is CVE-2026-11807?

It is a missing authorization vulnerability in the Event-Driven Ansible websocket API, where the endpoint does not verify user permissions when processing Worker messages.

Is this vulnerability being actively exploited?

The record does not show a CISA KEV listing, and no active exploitation is confirmed in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.