CVE-2026-6266

HighCVSS 8.3

Published: 04/05/2026(UTC)Updated: 26/08/2026(UTC)Translated: 16/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.40%

33th percentile - higher than 33% of all known CVEs

Summary

A flaw was found in the AAP gateway where the user auto-link strategy, introduced in AAP 2.6, automatically links an external Identity Provider (IDP) identity to an existing AAP user account based on email matching without verifying email ownership. This allows a remote attacker to potentially hijack a victim's account or gain unauthorized access to other accounts, including administrative accounts, by manipulating the IDP-provided email.

Risk Assessment

The organization is at risk of account takeover, including administrative accounts, which could lead to unauthorized access to sensitive data and systems managed by AAP.

Recommendation

Immediately disable the user auto-link strategy in the AAP configuration or implement additional verification of email ownership before linking an IDP identity to an account.

Other vulnerabilities in AAP Gateway

CVE-2026-18141High
In the aap-gateway component of Ansible Automation Platform's Event-Driven Ansible (EDA), a vulnerability allows an unauthenticated remote attacker to bypass mTLS authentication for event streams. The attacker can manipulate the event stream URL and forge the HTTP Subject header, while the system inadvertently discloses the expected certificate subject in error messages.

Original NVD description (English source)

A flaw was found in the AAP gateway. The user auto-link strategy, introduced in AAP 2.6, automatically links an external Identity Provider (IDP) identity to an existing AAP user account based on email matching without verifying email ownership. This allows a remote attacker to potentially hijack a victim's account or gain unauthorized access to other accounts, including administrative accounts, by manipulating the IDP-provided email.