CVE-2026-11807 CRITICAL

CVE-2026-11807: Eda-server: websocket missing authorization allows credential theft via activation_id spoofing

Weakness CWE-862 · Missing authorization
Published June 23, 2026
Last update June 29, 2026
View on NVD All CVEs

CVSS base score

9.6/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

What the vulnerability does

01Description

A missing authorization vulnerability was found in the Event-Driven Ansible (EDA) websocket API. The /api/eda/ws/ansible-rulebook endpoint does not verify user permissions when processing Worker messages. Any authenticated user can send a forged message with an arbitrary activation_id to receive plaintext credentials associated with that activation, including OAuth tokens, vault passwords, and SSH keys.

Key dates

02Disclosure timeline

June 23, 2026 CVE published
June 29, 2026 Record updated