The Event-Driven Ansible (EDA) websocket API endpoint /api/eda/ws/ansible-rulebook fails to validate user permissions when processing worker messages. This oversight allows any authenticated user to forge a message containing an arbitrary activation_id and obtain plain‑text credentials tied to that activation, such as OAuth tokens, vault passwords, and SSH keys. The flaw is a direct result of missing authorization checks, corresponding to CWE‑862.

The vulnerability affects Red Hat Ansible Automation Platform releases 2, 2.5, and 2.6 on both EL8 and EL9 platforms. These products host the EDA websocket service and are identified by the corresponding cpe entries for redhat:ansible_automation_platform in the affected versions.

The CVSS score of 9.6 marks this issue as critical, and the EPSS score is currently unavailable, indicating limited publicly known data on exploitation attempts. It is not listed in the CISA KEV catalog, but the nature of the flaw—unauthorized credential disclosure via a publicly reachable websocket endpoint—implies a high likelihood of remote exploitation by any authenticated without permission checks. An attacker can readily obtain sensitive credentials once authenticated, potentially leading to further lateral movement or system compromise.