What is the CVSS score of CVE-2026-11807?

CVE-2026-11807 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Ansible Automation Platform are affected by CVE-2026-11807?

Red Hat Ansible Automation Platform versions 2.5 and 2.6 contain a critical credential disclosure vulnerability (CVSS 9.6) affecting OAuth tokens, vault passwords, and SSH keys.. A patch is available.

How to fix or mitigate CVE-2026-11807?

24 hours: Identify all Ansible Automation Platform 2.5 and 2.6 deployments; restrict network access to /api/eda/ws/ansible-rulebook endpoint via firewall rules; review audit logs for suspicious Worker message activity and credential access. 7 days: Implement WAF or API gateway rules to block direct websocket connections except from authorized sources; rotate all OAuth tokens, vault passwords, and SSH keys stored in affected instances; force user re-authentication. 30 days: Subscribe to Red Hat security advisories for patch notification; upgrade to patched version upon release; implement additional authorization validation on activation_id parameters; establish continuous monitoring for abnormal credential access patterns.

Ansible Automation Platform CVE-2026-11807

EUVD-2026-38598 CRITICAL

Missing Authorization (CWE-862)

2026-06-23 redhat

GHSA-3w6r-r33r-cfg6

Hashicorp Authentication Bypass Red Hat Ansible Automation Platform 2 5 Red Hat Ansible Automation Platform 2 6 Red Hat Ansible Automation Platform 2

9.6

CVSS 3.1 · Vendor: redhat

Severity by source

Vendor (redhat) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

vuln.today AI

9.6 CRITICAL

Network-reachable websocket exploitable by any authenticated user (PR:L), no UI; leaks secrets that unlock other systems (S:C, C:H, I:H), no availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Red Hat

9.6 CRITICAL

qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 23, 2026 - 20:52 vuln.today

DescriptionCVE.org

A missing authorization vulnerability was found in the Event-Driven Ansible (EDA) websocket API. The /api/eda/ws/ansible-rulebook endpoint does not verify user permissions when processing Worker messages. Any authenticated user can send a forged message with an arbitrary activation_id to receive plaintext credentials associated with that activation, including OAuth tokens, vault passwords, and SSH keys.

Articles & Coverage 1

News Critical Credential Disclosure in HashiCorp/Red Hat Ansible Automation Platform - CVE-2026-11807 Jun 23, 2026

AnalysisAI

Credential disclosure in Red Hat Ansible Automation Platform 2.5 and 2.6 allows any authenticated user to retrieve plaintext OAuth tokens, vault passwords, and SSH keys by sending forged Worker messages to the Event-Driven Ansible websocket endpoint. The /api/eda/ws/ansible-rulebook endpoint fails to verify permissions on activation_id values, enabling lateral credential theft across tenants. No public exploit identified at time of analysis, but the low attack complexity and scope-changed CVSS of 9.6 make this a high-priority patch.

Technical ContextAI

The vulnerability resides in the Event-Driven Ansible (EDA) controller component of Red Hat Ansible Automation Platform, specifically in the websocket API at /api/eda/ws/ansible-rulebook. EDA uses websocket connections between rulebook worker processes and the controller to exchange activation state and credential material needed to execute automation. The flaw is a classic CWE-862 (Missing Authorization): the endpoint authenticates the user session but does not perform an authorization check tying the requesting user to the activation_id referenced in inbound Worker messages, so any forged message with another tenant's activation_id is honored and the controller responds with that activation's secret bundle (OAuth tokens, Ansible Vault passwords, SSH private keys). CPE data confirms Red Hat Ansible Automation Platform 2, 2.5, and 2.6 are affected.

RemediationAI

Apply the Red Hat patches available per vendor advisory by installing the updated EDA controller packages shipped in RHSA-2026:28492 (https://access.redhat.com/errata/RHSA-2026:28492) and RHSA-2026:28497 (https://access.redhat.com/errata/RHSA-2026:28497) for Ansible Automation Platform 2.5 and 2.6; exact fix versions should be taken from those errata. Until patching is possible, restrict EDA controller access to the minimum trusted operator set (since any authenticated EDA user can exploit this) and front the websocket endpoint with a reverse proxy that blocks /api/eda/ws/ansible-rulebook from non-operator network segments, accepting the trade-off that legitimate distributed rulebook workers in those segments will lose connectivity. Rotate all credentials managed by EDA - OAuth tokens, vault passwords, and SSH keys - after patching, on the assumption that any pre-patch user could have already harvested them.