CVE-2026-12383: Event-Driven Ansible Server Authentication Bypass

A high-severity vulnerability, CVE-2026-12383, has been identified in the Red Hat Event-Driven Ansible (EDA) server, specifically within the ExternalEventStreamViewSet component. This flaw stems from overly permissive access controls, utilizing permission_classes=[AllowAny] and authentication_classes=[], which negates proper authentication checks. The system relies solely on the Subject HTTP header for mTLS authentication without verifying that this header originates from a trusted proxy. An unauthenticated attacker capable of reaching the EDA API endpoint can craft a request with a spoofed Subject header to bypass mTLS, inject arbitrary events into normally protected event streams, and consequently trigger downstream automation actions. Furthermore, the vulnerability leaks the expected certificate Distinguished Name (DN) within 403 error responses, providing valuable information to potential attackers. This allows for unauthorized control over automated processes and sensitive data exposure.

Attack Chain

1. The attacker identifies a publicly accessible Event-Driven Ansible (EDA) API endpoint, specifically targeting the ExternalEventStreamViewSet.
2. The attacker crafts an HTTP POST request designed to interact with the EDA API.
3. The attacker researches the expected format for certificate Distinguished Names (DNs), potentially utilizing the DN leakage vulnerability if a 403 error was previously observed.
4. The attacker forges a Subject HTTP header in their request, embedding a spoofed Distinguished Name value to impersonate a trusted mTLS client.
5. Arbitrary event data is constructed and included in the body of the crafted HTTP POST request.
6. The attacker sends the malicious request to the vulnerable EDA API endpoint (/api/v1/externaleventstreams/).
7. Due to permissive access controls and lack of Subject header verification, the EDA server processes the request, bypassing mTLS authentication.
8. The injected arbitrary event triggers configured downstream automation actions, potentially leading to unauthorized system changes, data manipulation, or arbitrary code execution.

Impact

Successful exploitation of CVE-2026-12383 allows an unauthenticated attacker to gain unauthorized control over Event-Driven Ansible automation. By injecting arbitrary events, attackers can trigger any downstream automation actions configured within the EDA server, potentially leading to significant system compromise, data exfiltration, or denial of service, depending on the scope and privileges of the automated tasks. The vulnerability also leaks sensitive information, specifically the expected certificate Distinguished Name, in 403 error responses, which can aid further reconnaissance and exploitation attempts. With a CVSS v3.1 Base Score of 7.5, the impact is considered high, representing a critical risk to systems relying on EDA for automation.

Recommendation

• Patch CVE-2026-12383 by updating your Red Hat Event-Driven Ansible server to the latest secure version immediately.
• Deploy the Sigma rule "Detect CVE-2026-12383 Exploitation Attempt - Spoofed Subject Header" to your SIEM to alert on suspicious requests to the ExternalEventStreamViewSet.
• Review webserver access logs for cs-uri-stem values starting with /api/v1/externaleventstreams/ combined with unusual cs-header-subject values or HTTP POST methods.
• Audit your EDA server configurations for the ExternalEventStreamViewSet to ensure appropriate authentication and authorization mechanisms are enforced.
• Monitor webserver error logs for 403 HTTP status codes (sc-status: "403") to the /api/v1/externaleventstreams/ path and examine the response body for mentions of certificate Distinguished Names, which indicates information leakage.