Skip to content
Threat Feed
Subscribe

Product

AAP Gateway Envoy Proxy

1 brief RSS
high advisory

CVE-2026-12382 - AAP Gateway Envoy Proxy Authentication Bypass

A critical authentication bypass vulnerability (CVE-2026-12382) exists in the AAP Gateway Envoy proxy configuration within Red Hat Ansible Automation Platform 2 where the non-mTLS route to EDA event streams fails to remove the Subject HTTP header from client requests, allowing an unauthenticated remote attacker to inject a spoofed Subject header matching a legitimate client certificate DN to bypass mTLS authentication and inject arbitrary events into protected EDA event streams.

Red Hat Ansible Automation Platform 2 +1 cve authentication-bypass red-hat ansible proxy envoy
2t 1c