CVE-2026-12383

Name of the Vulnerable Software and Affected Versions Event-Driven Ansible (EDA) server (affected versions not specified)

Description The Event-Driven Ansible (EDA) server contains a flaw in the ExternalEventStreamViewSet due to permissive access controls. The system relies exclusively on the Subject HTTP header for mTLS (mutual Transport Layer Security) authentication—a process where both client and server verify each other's certificates—without confirming that the header was sent by a trusted proxy. Furthermore, the 403 error response body leaks the expected certificate Distinguished Name. An attacker capable of reaching the API endpoint with a spoofed Subject header can inject arbitrary events into protected event streams to trigger downstream automation actions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.