Event-Driven Ansible: websocket Worker messages are unauthorized, returning plaintext credentials for any activation

Impact

The EDA websocket endpoint /api/eda/ws/ansible-rulebook does not check user permissions when handling Worker messages. Any authenticated user can send a forged message naming an arbitrary activation_id and receive the plaintext credentials attached to that activation - OAuth tokens, vault passwords and SSH keys. Where EDA drives automation against a GPU fleet, that hands a low-privileged account the keys the automation uses to reach nodes, BMCs and cluster APIs, which turns into node-level access without any further flaw.

Who can reach it

Any authenticated AAP user able to open the EDA websocket endpoint over the network; no special role required.

What to do

Apply the Red Hat errata for your AAP release (RHSA-2026:28376/28377/28440/28492/28497 cover 2.5 through 2.7) and restart the EDA services. Because credentials may already have been read, rotate every secret bound to an EDA activation - OAuth tokens, vault passwords and SSH keys - after patching.

References

Related entries

• AAP Controller: testing a Vault credential sends the controller pod's service account token to an attacker URLCVE-2026-12564 · Red Hat Ansible Automation Platform Controller (awx_plugins HashiCorp Vault credential plugin)Critical
• Termix: any authenticated user can read other users' stored SSH and sudo passwordsCVE-2026-53548 · Termix (GET /host/db/host/:id/password credential endpoint)Critical
• Progress LoadMaster (ADC): OS command injection in the APICVE-2026-8037 · Progress LoadMaster (ADC)Critical
• Vault Secrets Operator: tenant-controlled AppRole config reads operator pod files and exfiltrates themCVE-2026-8715 · HashiCorp Vault Secrets Operator (AppRole secretIDPath configuration)Critical
• Johnson Controls Metasys Application and Data Server (ADS) deployed with SQL Express: Command injection on the MetasysCVE-2025-26385 · Johnson Controls Metasys Application and Data Server (ADS) deployed with SQL ExpressCritical
• Citrix NetScaler ADC/Gateway: unauthenticated attacker executes arbitrary commands on the applianceCVE-2026-88771 · Citrix NetScaler ADC / Gateway (input validation in the management/authentication request path)Critical