CVE-2026-11807: Eda-server: websocket missing authorization allows credential theft via activation_id spoofing
A missing authorization vulnerability was found in EDA (Event-Driven Ansible). The websocket endpoint at /api/eda/ws/ansible-rulebook does not verify that the authenticated user has permission to access the specified activation. The handleworkers() method in consumers.py performs a direct database lookup by activationid without permission filtering. Any authenticated user, even with zero EDA permissions, can send a forged Worker message with any activationid and receive plaintext credentials including AAP Controller OAuth tokens, vault passwords, SSH private keys, and TLS certificates.
Other sources
A missing authorization vulnerability was found in the Event-Driven Ansible (EDA) websocket API. The /api/eda/ws/ansible-rulebook endpoint does not verify user permissions when processing Worker messages. Any authenticated user can send a forged message with an arbitrary activationid to receive plaintext credentials associated with that activation, including OAuth tokens, vault passwords, and SSH keys.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11807?
The severity of CVE-2026-11807 is rated as critical with a score of 9.6.
How do I fix CVE-2026-11807?
To resolve CVE-2026-11807, ensure that proper authorization checks are implemented for the websocket endpoint to prevent unauthorized access.
What risks are associated with CVE-2026-11807?
CVE-2026-11807 poses a risk of credential theft via activation_id spoofing due to the missing authorization in the websocket.
Who is affected by CVE-2026-11807?
Any user or application utilizing the EDA (Event-Driven Ansible) websocket endpoint at /api/eda/ws/ansible-rulebook may be affected by CVE-2026-11807.
When was CVE-2026-11807 published?
CVE-2026-11807 was published on June 9, 2026.