CVE-2026-12383

Summary

A flaw was found in the Event-Driven Ansible (EDA) server. The ExternalEventStreamViewSet uses permissive access controls (permission_classes=[AllowAny], authentication_classes=[]) and relies solely on the Subject HTTP header value for mTLS authentication without verifying that the header originated from a trusted proxy. Additionally, the expected certificate Distinguished Name is leaked in the 403 error response body. An attacker who can reach the EDA API endpoint with a spoofed Subject header can inject arbitrary events into mTLS-protected event streams, triggering downstream automation actions.

Affected Software

VendorProductVersion RangeStatus

Weaknesses

  • CWE-345: Insufficient Verification of Data Authenticity

Workarounds

The following practices would help for avoiding exposure and mitigate this flaw:

  • Ensure the EDA server is not directly accessible from untrusted networks; all traffic should route through the AAP Gateway which should perform mTLS validation.
  • If possible, configure network-level access controls to restrict which source IPs can reach the EDA backend API.
  • Monitor EDA event streams for unexpected events_received counter changes.
  • Review and rotate mTLS client certificates if unauthorized access is suspected, as the expected DN may have been leaked via the 403 error response.

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: yes
    • Technical Impact: partial

References