CVE-2026-11807

Name of the Vulnerable Software and Affected Versions Event-Driven Ansible (affected versions not specified)

Description A missing authorization issue exists in the websocket API. The '/api/eda/ws/ansible-rulebook' endpoint fails to verify user permissions when processing Worker messages. This allows any authenticated user to send a forged message containing an arbitrary activation id to obtain plaintext credentials associated with that activation, such as OAuth tokens, vault passwords, and SSH keys.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.