CVE-2026-11807: Eda-server: websocket missing authorization allows credential theft via activation_id spoofing

Synopsis

A missing authorization vulnerability in Event-Driven Ansible (EDA) allows any authenticated user to steal credentials from other activations via the websocket API. The flaw is reachable over the network and requires only a low-privilege account; no victim interaction is needed. Successful exploitation gives the attacker plaintext OAuth tokens, vault passwords, and SSH keys belonging to other users or automation workflows. A patched-image rebuild is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable websocket endpoint is exposed over the network, so the attacker must be able to reach the EDA server's API from a network-adjacent or internet-routable position.

• AuthenticationRequired

  Any low-privilege account is sufficient; the attacker only needs valid credentials to authenticate to the platform before sending a forged Worker message.

• Victim interactionNot required

  The attacker interacts directly with the websocket API; no action is required from any other user.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special race conditions, memory layout knowledge, or environmental prerequisites.

Blast Radius

• Attacker reads plaintext OAuth tokens associated with arbitrary automation activations, enabling impersonation of those integrations against external services.
• Attacker retrieves vault passwords in cleartext, unlocking encrypted secrets stored across any Ansible vault tied to an affected activation.
• Attacker obtains SSH private keys from other users' activations, gaining direct shell access to any host those keys authorize.
• The confidentiality and integrity of all managed infrastructure is at risk, because the stolen credentials can be used to modify automation workflows or access downstream systems.