CVE-2026-11807
Eda-server: websocket missing authorization allows credential theft via activation_id spoofing
Description
A missing authorization vulnerability was found in the Event-Driven Ansible (EDA) websocket API. The /api/eda/ws/ansible-rulebook endpoint does not verify user permissions when processing Worker messages. Any authenticated user can send a forged message with an arbitrary activation_id to receive plaintext credentials associated with that activation, including OAuth tokens, vault passwords, and SSH keys.
INFO
Published Date :
June 23, 2026, 7:40 p.m.
Last Modified :
June 23, 2026, 7:43 p.m.
Remotely Exploit :
Yes !
Source :
redhat
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | CRITICAL | 53f830b8-0a3f-465b-8143-3b8a9948e749 |
Solution
- Implement authorization checks for the /api/eda/ws/ansible-rulebook endpoint.
- Validate user permissions before processing Worker messages.
- Ensure all sensitive data access requires proper authorization.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-11807 vulnerability anywhere in the article.