EUVD-2026-49406
GHSA-c4xf-fv75-hwxm
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in the Event-Driven Ansible (EDA) server. The ExternalEventStreamViewSet uses permissive access controls (permission_classes=[AllowAny], authentication_classes=[]) and relies solely on the Subject HTTP header value for mTLS authentication without verifying that the header originated from a trusted proxy. Additionally, the expected certificate Distinguished Name is leaked in the 403 error response body. An attacker who can reach the EDA API endpoint with a spoofed Subject header can inject arbitrary events into mTLS-protected event streams, triggering downstream automation actions.
AnalysisAI
Unauthenticated remote attackers can inject arbitrary events into mTLS-protected event streams in Event-Driven Ansible (EDA) server by spoofing the Subject HTTP header, bypassing mTLS authentication. The vulnerability arises from permissive access controls on the ExternalEventStreamViewSet and reliance on an untrusted Subject header, combined with leakage of the expected Distinguished Name in error responses. No active exploitation or public exploit is confirmed at this time, but the high integrity impact and low attack complexity make it a significant risk.
Same technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today