https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T03:40:34.411378+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-11807 CVE-2026-11807 — Eda-server: websocket missing authorization allows credential theft via activation_id spoofing 2026-10-06T03:40:34.413312+00:00

Affected: Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9, Red Hat Ansible Automation Platform 2.6 for RHEL 9, Red Hat Ansible Automation Platform 2.5, Red Hat Ansible Automation Platform 2.6, Red Hat Ansible Automation Platform 2.7

A missing authorization vulnerability was found in the Event-Driven Ansible (EDA) websocket API. The /api/eda/ws/ansible-rulebook endpoint does not verify user permissions when processing Worker messages. Any authenticated user can send a forged message with an arbitrary activation_id to receive plaintext credentials associated with that activation, including OAuth tokens, vault passwords, and SSH keys.