CyberRota
← Ana sayfaya dön

CVE-2026-11807

CRITICAL · CVSS 9.6 EPSS %0.37

Kaynak: NVD + CISA KEV + EPSS · Yayınlanma: 2026-06-23T21:16:54.350 · Çekilme zamanı: 2026-06-30T18:30:39.247488+00:00

CyberRota Yorumu

Saldırganın giriş yapmış olması gerekebilir.

CVE
CVE-2026-11807
Severity
CRITICAL
CVSS
9.6
EPSS
%0.37

Orijinal NVD Açıklaması

A missing authorization vulnerability was found in the Event-Driven Ansible (EDA) websocket API. The /api/eda/ws/ansible-rulebook endpoint does not verify user permissions when processing Worker messages. Any authenticated user can send a forged message with an arbitrary activation_id to receive plaintext credentials associated with that activation, including OAuth tokens, vault passwords, and SSH keys.