CVE-2026-12382

Name of the Vulnerable Software and Affected Versions Ansible Automation Platform (affected versions not specified)

Description A flaw in the AAP Gateway Envoy proxy configuration allows an unauthenticated remote attacker to bypass mTLS authentication. The non-mTLS route to EDA event streams fails to remove the Subject HTTP header from client requests. By injecting a spoofed Subject header that matches a legitimate client certificate Distinguished Name (DN), an attacker can inject arbitrary events into protected EDA event streams.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.