CVE-2026-11807
CriticalCVSS 9.6Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
A missing authorization vulnerability exists in the Event-Driven Ansible (EDA) websocket API. The /api/eda/ws/ansible-rulebook endpoint does not verify user permissions, allowing any authenticated user to send a forged message with an arbitrary activation_id to receive plaintext credentials, including OAuth tokens, vault passwords, and SSH keys.
Risk Assessment
The risk involves exposure of sensitive credentials, potentially leading to unauthorized access to Ansible-managed systems and privilege escalation within the IT environment.
Recommendation
Immediately update Event-Driven Ansible to a patched version and implement authorization checks for all WebSocket endpoints.
Original NVD description (English source)
A missing authorization vulnerability was found in the Event-Driven Ansible (EDA) websocket API. The /api/eda/ws/ansible-rulebook endpoint does not verify user permissions when processing Worker messages. Any authenticated user can send a forged message with an arbitrary activation_id to receive plaintext credentials associated with that activation, including OAuth tokens, vault passwords, and SSH keys.