CVEvulnerability

CVE-2026-12382

8.2 HIGH Published 2026-07-15 Modified 2026-08-12 Official page ↗
Status
Awaiting Analysis
Published
2026-07-15
Last modified
2026-08-12
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.2 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Weaknesses
CWE-290

Description

A flaw was found in the AAP Gateway Envoy proxy configuration. The non-mTLS route to EDA event streams does not remove the Subject HTTP header from client requests, despite the source code defining requestHeadersToRemove for this header. An unauthenticated remote attacker can inject a spoofed Subject header matching a legitimate client certificate DN to bypass mTLS authentication and inject arbitrary events into protected EDA event streams.

Related

Weakness · CWE (1)

  • CWE-290 Authentication Bypass by Spoofing weakness

References