CVE-2026-11807 Red Hat CVE debrief

Who should care

Organizations using Event-Driven Ansible (EDA) should prioritize patching this vulnerability. Any authenticated user can exploit this flaw to gain unauthorized access to sensitive credentials, potentially leading to further system compromise. The vulnerability's critical severity and potential for significant impact make it essential for EDA users to address immediately.

Technical summary

The Event-Driven Ansible (EDA) websocket API has a missing authorization vulnerability at the /api/eda/ws/ansible-rulebook endpoint. This endpoint does not properly verify user permissions when processing Worker messages. Consequently, any authenticated user can send a forged message with an arbitrary activation_id. This action allows the user to receive plaintext credentials associated with that activation, including OAuth tokens, vault passwords, and SSH keys. The vulnerability is rated with a CVSS score of 9.6, indicating critical severity. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N, highlighting the vulnerability's high impact on confidentiality and integrity.

Defensive priority

This vulnerability requires immediate attention due to its critical severity and potential for significant impact. Organizations using Event-Driven Ansible (EDA) should prioritize patching to prevent unauthorized access to sensitive credentials.

Recommended defensive actions

• Apply patches or updates provided by the vendor to address the missing authorization vulnerability.
• Implement additional monitoring to detect and respond to potential exploitation attempts.
• Review and update authentication and authorization configurations for the EDA websocket API.
• Consider implementing compensating controls, such as limiting access to sensitive credentials.
• Conduct a thorough inventory check to identify and patch all affected systems.

Evidence notes

The CVE-2026-11807 record was obtained from the official CVE database and the National Vulnerability Database (NVD). The vulnerability is associated with multiple references from Red Hat, including errata and bugzilla entries. While the vendor name is listed as 'Unknown Vendor,' evidence suggests a strong connection to Red Hat, given the presence of Red Hat references and errata.

Official resources