What is the CVSS score of CVE-2026-18141?

CVE-2026-18141 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of Ansible aap-gateway are affected by CVE-2026-18141?

Red Hat Ansible Automation Platform's Event-Driven Ansible gateway contains an unauthenticated remote authentication bypass (CVE-2026-18141, CVSS 8.2) that allows attackers to inject arbitrary events…

How to fix or mitigate CVE-2026-18141?

Within 24 hours: Identify all aap-gateway instances exposed to untrusted networks and document their external connectivity. Within 7 days: Implement network-level access controls restricting aap-gateway communication to authorized internal systems only; deploy a reverse proxy or API gateway layer with strict request validation for event streams. Within 30 days: Establish a support engagement with Red Hat to confirm patch availability and timeline; implement complementary authentication controls such as event signing, external API authentication, or temporary component isolation until patching is available.

Ansible aap-gateway CVE-2026-18141

EUVD-2026-51556 HIGH

Improper Certificate Validation (CWE-295)

2026-07-31 secalert@redhat.com

GHSA-9cwv-qxgx-ff4x

Information Disclosure

8.2

CVSS 3.1 · Vendor: redhat

Severity by source

Vendor (redhat) PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

vuln.today AI

8.2 HIGH

Network-reachable endpoint requires no credentials (PR:N); I:H for arbitrary event injection triggering workflows; C:L for certificate subject disclosure in error responses.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:L/SA:N

Red Hat

8.2 HIGH

qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 16:34 vuln.today

CVE Published

Jul 31, 2026 - 16:17 nvd

HIGH 8.2

DescriptionCVE.org

A flaw was found in aap-gateway, a component of Ansible Automation Platform's Event-Driven Ansible (EDA). An unauthenticated remote attacker can bypass mutual Transport Layer Security (mTLS) authentication for event streams. This is achieved by manipulating the event stream URL and forging the HTTP Subject header. The system also inadvertently discloses the expected certificate subject in error messages, which simplifies the attack. This vulnerability allows an attacker to inject arbitrary events into EDA, potentially triggering automated workflows.

AnalysisAI

mTLS authentication bypass in aap-gateway, the gateway component of Red Hat Ansible Automation Platform's Event-Driven Ansible (EDA), permits unauthenticated remote attackers to inject arbitrary events into automation workflows. The bypass exploits event stream URL manipulation and HTTP Subject header forgery; the attack surface is further reduced by the component's inadvertent disclosure of the expected TLS certificate subject in error responses (CWE-295). No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and CVSS 8.2 score make this a credible priority for organizations running EDA-integrated automation pipelines.

Technical ContextAI

aap-gateway is the ingress and gateway component of Ansible Automation Platform that handles event stream routing for Event-Driven Ansible. Mutual TLS (mTLS) is used to authenticate event stream sources by requiring the client to present a valid certificate whose subject matches an expected value. CWE-295 (Improper Certificate Validation) is the root cause: the system trusts an attacker-controlled HTTP header (the 'Subject' header) to determine certificate identity rather than validating the actual TLS certificate presented during the handshake. Compounding this, the gateway leaks the expected certificate subject in error messages, providing attackers a reconnaissance-free path to construct valid forgeries without needing prior knowledge of the PKI configuration. The combination of header trust and error message verbosity collapses what should be a cryptographically strong authentication mechanism into a trivially forgeable header check.

Affected ProductsAI

The vulnerability affects aap-gateway, a component of Red Hat Ansible Automation Platform's Event-Driven Ansible (EDA). Specific affected version ranges are not enumerated in the available NVD data; no CPE strings were included in the provided intelligence. Authoritative version scope must be verified against the Red Hat security advisory at https://access.redhat.com/security/cve/CVE-2026-18141 and the Bugzilla report at https://bugzilla.redhat.com/show_bug.cgi?id=2508155.

RemediationAI

Consult the Red Hat security advisory at https://access.redhat.com/security/cve/CVE-2026-18141 and the associated Bugzilla entry at https://bugzilla.redhat.com/show_bug.cgi?id=2508155 for the vendor-released patch; an exact fix version is not confirmed in the available intelligence data and should not be inferred. As an immediate compensating control, restrict network access to aap-gateway event stream endpoints to known trusted source IP ranges using firewall rules or Kubernetes network policies - this reduces the attack surface but does not remediate the underlying header-forgery flaw. Additionally, configure aap-gateway to suppress verbose error messages that disclose expected certificate subject information; this closes the reconnaissance vector that simplifies exploitation, though it only marginally increases attack difficulty since the certificate subject may be independently discoverable. Neither compensating control is a substitute for the vendor patch, which should be applied as the primary remediation action once the fixed version is confirmed.