HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-18141 — A flaw was found in aap-gateway, a component of Ansible Automation Platform's Ev...

·Source: NIST NVD

Updated:

Executive Summary

A flaw was found in aap-gateway, a component of Ansible Automation Platform's Event-Driven Ansible (EDA). An unauthenticated remote attacker can bypass mutual Transport Layer Security (mTLS) authentication for event streams. This is achieved by manipulating the event stream URL and forging the HTTP Subject header. The system also inadvertently discloses the expected certificate subject in error me

Analysis

A flaw was found in aap-gateway, a component of Ansible Automation Platform's Event-Driven Ansible (EDA). An unauthenticated remote attacker can bypass mutual Transport Layer Security (mTLS) authentication for event streams. This is achieved by manipulating the event stream URL and forging the HTTP Subject header. The system also inadvertently discloses the expected certificate subject in error messages, which simplifies the attack. This vulnerability allows an attacker to inject arbitrary events into EDA, potentially triggering automated workflows. CVSS Score: 8.2. Published: 2026-07-31T16:17:05.387.

Indicators of Compromise (1)

CVE (1)
CVE-2026-18141
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Jul 31, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

ISMG Editors: A New Front in the Naming War

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/ismg-editors-new-front-in-naming-war-image_small-7-a-32387.jpg" align=right hspace=4><b>Also: The AI Spending Reality Check, Nvidia Takes on Closed AI</b><br>In this week's panel, four ISMG editors discussed Google's controversial new threat actor naming system and the need for standardization, whether the artificial intelligence

Bank Info Security
MEDIUMVulnerabilityNEW

CISA warns of spike in attacks on water systems as Minnesota incidents probed

The Cybersecurity and Infrastructure Security Agency said in a public alert on Thursday that facilities should “remove publicly exposed PLCs and other operational technology (OT) from the internet as soon as possible."

The Record
MEDIUMVulnerability

Hacker uses DeepSeek AI to autonomously attack vulnerable servers

A Chinese-speaking threat actor is using the DeepSeek AI model and the open-source Hermes Agent to conduct autonomous cyberattacks on exposed servers with limited human involvement. [...]

BleepingComputer