Aap-gateway, part of Red Hat Ansible Automation Platform 2’s Event‑Driven Ansible, contains an authentication bypass that allows an unauthenticated remote attacker to circumvent mutual TLS protection on event streams. By manipulating the event‑stream URL and forging the HTTP Subject header, an attacker can inject arbitrary events into EDA. Error messages unintentionally reveal the expected certificate subject, reducing the effort required to craft a valid request. This flaw could enable the attacker to trigger automated workflows, potentially compromising the confidentiality, integrity, and availability of the infrastructure being managed.

All deployments of Red Hat Ansible Automation Platform 2 that include the aap‑gateway component are affected. This includes any environment running the default installation of Ansible Automation Platform 2 where the EDA event‑stream feature is enabled.

The CVSS score of 8.2 indicates a high severity vulnerability. The EPSS score is less than 1 %, implying that the probability of exploitation is currently very low, but the flaw is still exploitable from any source that can reach the event‑stream endpoints. The vulnerability is not listed in the CISA KEV catalog. An unauthenticated external host that can send HTTP requests to the event‑stream URL, bypassing mTLS through a forged Subject header, is a likely attack vector. Exploitation would not require privileged authentication on the platform, making the flaw broadly exploitable in exposed environments.