CVE-2026-11807

CriticalCVSS 9.6/10Last modified Nov 4, 2026

Description

A missing authorization vulnerability was found in the Event-Driven Ansible (EDA) websocket API. The /api/eda/ws/ansible-rulebook endpoint does not verify user permissions when processing Worker messages. Any authenticated user can send a forged message with an arbitrary activation_id to receive plaintext credentials associated with that activation, including OAuth tokens, vault passwords, and SSH keys.

Metrics

CVSS 3.1 9.6/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Weakness enumeration

CWE-862

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 8—
Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 9—
Red HatRed Hat Ansible Automation Platform 2.6 for RHEL 9—
Red HatRed Hat Ansible Automation Platform 2.5—
Red HatRed Hat Ansible Automation Platform 2.6—
Red HatRed Hat Ansible Automation Platform 2.7—
Red HatRed Hat Ansible Automation Platform 2—
Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 8—
Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 9—
Red HatRed Hat Ansible Automation Platform 2.6 for RHEL 9—
Red HatRed Hat Ansible Automation Platform 2.5—
Red HatRed Hat Ansible Automation Platform 2.6—
Red HatRed Hat Ansible Automation Platform 2.7—

References

Timeline

Published
Jun 23, 2026
Last modified
Nov 4, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1180707.2The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gid' parameter in all versions up to, and CVE-2026-1180716.8The Joinchat WordPress plugin before 6.4.2 does not escape the message of its button block before outputting it in an HTML attribute on theCVE-2026-1180725.4The Fraud Prevention For WooCommerce and EDD WordPress plugin before 2.3.6 does not check that a user is allowed to manage orders before letCVE-2026-1180738.8Subscriber PHP Object Injection in News Kit Elementor Addons <= 1.5.0 versions.CVE-2026-1180747.2Shop manager PHP Object Injection in Finale Lite <= 2.21.0 versions.CVE-2026-1180758.8Contributor PHP Object Injection in WP Media folders <= 1.1.10 versions.CVE-2026-1180768.8Contributor PHP Object Injection in Frisbii Pay <= 1.8.19 versions.CVE-2026-1180777.2Author PHP Object Injection in Sastra Essential Addons for Elementor <= 1.2.3 versions.CVE-2026-1180787.2Shop manager PHP Object Injection in Product Catalog Feed by PixelYourSite <= 3.1.4 versions.CVE-2026-1180797.2Deserialization of Untrusted Data vulnerability in FolioVision FV Flowplayer Video Player fv-wordpress-flowplayer allows Object Injection.ThCVE-2026-1180808.8Contributor PHP Object Injection in Social Snap <= 1.5.4 versions.CVE-2026-1180818.8Contributor PHP Object Injection in 10Web Social Photo Feed <= 1.5.6 versions.
CVE-2026-11807: Critical severity, CVSS 9.6 | Vulnix