{"affected":[{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-eda-controller","product":"Red Hat Ansible Automation Platform 2.5 for RHEL 8","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.1.19-1.el8ap","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-eda-controller","product":"Red Hat Ansible Automation Platform 2.5 for RHEL 9","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.1.19-1.el9ap","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-eda-controller","product":"Red Hat Ansible Automation Platform 2.6 for RHEL 9","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.2.9-2.el9ap","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://catalog.redhat.com/software/containers/","packageName":"ansible-automation-platform-25/eda-controller-rhel8","product":"Red Hat Ansible Automation Platform 2.5","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1781741251","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://catalog.redhat.com/software/containers/","packageName":"ansible-automation-platform-26/eda-controller-rhel9","product":"Red Hat Ansible Automation Platform 2.6","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1781732675","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://catalog.redhat.com/software/containers/","packageName":"ansible-automation-platform-27/eda-controller-rhel9","product":"Red Hat Ansible Automation Platform 2.7","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1781730525","versionType":"rpm"}]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ansible-automation-platform-24/eda-controller-rhel8","product":"Red Hat Ansible Automation Platform 2","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-eda-controller","product":"Red Hat Ansible Automation Platform 2.5 for RHEL 8","source":"ADP: redhat-SADP","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.1.19-1.el8ap","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-eda-controller","product":"Red Hat Ansible Automation Platform 2.5 for RHEL 9","source":"ADP: redhat-SADP","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.1.19-1.el9ap","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-eda-controller","product":"Red Hat Ansible Automation Platform 2.6 for RHEL 9","source":"ADP: redhat-SADP","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.2.9-2.el9ap","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://catalog.redhat.com/software/containers/","packageName":"ansible-automation-platform-25/eda-controller-rhel8","product":"Red Hat Ansible Automation Platform 2.5","source":"ADP: redhat-SADP","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1781741251","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://catalog.redhat.com/software/containers/","packageName":"ansible-automation-platform-26/eda-controller-rhel9","product":"Red Hat Ansible Automation Platform 2.6","source":"ADP: redhat-SADP","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1781732675","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://catalog.redhat.com/software/containers/","packageName":"ansible-automation-platform-27/eda-controller-rhel9","product":"Red Hat Ansible Automation Platform 2.7","source":"ADP: redhat-SADP","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1781730525","versionType":"rpm"}]}],"cveId":"CVE-2026-11807","cwes":["CWE-862"],"description":"A missing authorization vulnerability was found in the Event-Driven Ansible (EDA) websocket API. The /api/eda/ws/ansible-rulebook endpoint does not verify user permissions when processing Worker messages. Any authenticated user can send a forged message with an arbitrary activation_id to receive plaintext credentials associated with that activation, including OAuth tokens, vault passwords, and SSH keys.","epss":{"date":"2026-11-04","percentile":0.45008,"score":0.00531},"exploits":[],"kev":null,"metrics":[{"score":9.6,"severity":"critical","source":"CNA: redhat","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},{"score":9.6,"severity":"critical","source":"ADP: redhat-SADP","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},{"score":9.6,"severity":"critical","source":"NVD: secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},{"score":9.6,"severity":"critical","source":"NVD: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","version":"3.1"}],"modifiedAt":1793830672960,"publishedAt":1782243633182,"references":[{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:28376"},{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:28377"},{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:28440"},{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:28492"},{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:28497"},{"source":"CNA: redhat","tags":["vdb-entry","x_refsource_REDHAT"],"url":"https://access.redhat.com/security/cve/CVE-2026-11807"},{"source":"CNA: redhat","tags":["issue-tracking","x_refsource_REDHAT"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2487036"},{"source":"ADP: redhat-SADP","tags":["vdb-entry","x_refsource_REDHAT"],"url":"https://access.redhat.com/security/cve/CVE-2026-11807"},{"source":"ADP: redhat-SADP","tags":["issue-tracking","x_refsource_REDHAT"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2487036"},{"source":"ADP: redhat-SADP","tags":["x_sadp-csaf-vex"],"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11807.json"},{"source":"ADP: redhat-SADP","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:28376"},{"source":"ADP: redhat-SADP","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:28377"},{"source":"ADP: redhat-SADP","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:28497"},{"source":"ADP: redhat-SADP","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:28492"},{"source":"ADP: redhat-SADP","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:28440"},{"source":"secalert@redhat.com","tags":[],"url":"https://access.redhat.com/errata/RHSA-2026:28376"},{"source":"secalert@redhat.com","tags":[],"url":"https://access.redhat.com/errata/RHSA-2026:28377"},{"source":"secalert@redhat.com","tags":[],"url":"https://access.redhat.com/errata/RHSA-2026:28440"},{"source":"secalert@redhat.com","tags":[],"url":"https://access.redhat.com/errata/RHSA-2026:28492"},{"source":"secalert@redhat.com","tags":[],"url":"https://access.redhat.com/errata/RHSA-2026:28497"},{"source":"secalert@redhat.com","tags":[],"url":"https://access.redhat.com/security/cve/CVE-2026-11807"},{"source":"secalert@redhat.com","tags":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2487036"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":[],"url":"https://access.redhat.com/errata/RHSA-2026:28376"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":[],"url":"https://access.redhat.com/errata/RHSA-2026:28377"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":[],"url":"https://access.redhat.com/errata/RHSA-2026:28440"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":[],"url":"https://access.redhat.com/errata/RHSA-2026:28492"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":[],"url":"https://access.redhat.com/errata/RHSA-2026:28497"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":[],"url":"https://access.redhat.com/security/cve/CVE-2026-11807"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2487036"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":[],"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11807.json"}],"remediation":[{"kind":"workaround","source":"CNA: redhat","text":"The following practices would help for reducing or avoiding the exposure to this flaw:\n\n1) Restrict network access to the EDA websocket endpoint.\n2) Review and limit user accounts with any level of Ansible Automation Platform authentication until the fix is applied."},{"kind":"fix","source":"ADP: redhat-SADP","text":"RHSA-2026:28376: Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9\n\nRHSA-2026:28377: Red Hat Ansible Automation Platform 2.6 for RHEL 9\n\nRHSA-2026:28497: Red Hat Ansible Automation Platform 2.5\n\nRHSA-2026:28492: Red Hat Ansible Automation Platform 2.6\n\nRHSA-2026:28440: Red Hat Ansible Automation Platform 2.7"},{"kind":"workaround","source":"ADP: redhat-SADP","text":"The following practices would help for reducing or avoiding the exposure to this flaw:\n\n1) Restrict network access to the EDA websocket endpoint.\n2) Review and limit user accounts with any level of Ansible Automation Platform authentication until the fix is applied."}],"revision":"cb5a73c36f272403f380c781b077dda8592c5dca8e1694d8a3e8cd11f12b256d","sources":[{"modifiedAt":1793829068848,"name":"CNA: redhat","retrievedAt":1793830329236,"url":"https://www.cve.org/CVERecord?id=CVE-2026-11807"},{"modifiedAt":1793830672960,"name":"NVD","retrievedAt":1793838027298,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11807"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793830356191,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-11807"}],"ssvc":{"assessedAt":1782325341415,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Eda-server: websocket missing authorization allows credential theft via activation_id spoofing","updatedAt":1793838027298}