The Event‑Driven Ansible (EDA) server’s ExternalEventStreamViewSet allows requests that provide any Subject header without verification, because permission classes permit unauthenticated access. The view trusts the Subject header value for mTLS authentication and leaks the expected certificate Distinguished Name in a 403 error, enabling an attacker who can reach the EDA API endpoint to spoof the Subject header and inject arbitrary events into protected event streams. These injected events can trigger downstream automation workflows, potentially granting the attacker the ability to execute commands on managed hosts. The weakness is a form of CWE‑345, an authorization bypass.

Red Hat Ansible Automation Platform 2 is affected. The vulnerability applies to the EDA component of the platform, version 2 (indicated by the CPE for Ansible Automation Platform 2). No other product versions are listed as affected.

The CVSS score of 7.5 classifies this issue as high severity. Although the EPSS score is < 1%, the lack of a KEV listing suggests that exploitation is not yet widely reported in the wild. The flaw is remotely exploitable over the EDA API HTTP endpoint; an attacker needs network connectivity to the service and the ability to send HTTP requests with a forged Subject header. Because the server trusts this header and does not validate that it originates from a trusted proxy, an attacker can bypass authentication entirely. Mitigations from the vendor include restricting external access, routing traffic through the AAP Gateway with mutual TLS, and monitoring event streams for abnormal activity. Until a patch is available, applying the vendor‑provided workaround is recommended.