Cyber Posture

CVE-2026-6266

High

Published: 04 May 2026

Published
04 May 2026
Modified
04 May 2026
KEV Added
—
Patch
—
CVSS Score 8.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
EPSS Score 0.0004 12.6th percentile
Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Description

A flaw was found in the AAP gateway. The user auto-link strategy, introduced in AAP 2.6, automatically links an external Identity Provider (IDP) identity to an existing AAP user account based on email matching without verifying email ownership. This allows…

more

a remote attacker to potentially hijack a victim's account or gain unauthorized access to other accounts, including administrative accounts, by manipulating the IDP-provided email.

Security SummaryAI

CVE-2026-6266 is a vulnerability in the Ansible Automation Platform (AAP) gateway, specifically affecting the user auto-link strategy introduced in AAP 2.6. This feature automatically links an external Identity Provider (IDP) identity to an existing AAP user account based solely on email matching, without verifying email ownership. Published on 2026-05-04, the flaw carries a CVSS v3.1 base score of 8.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L) and is associated with CWE-305 (Authentication Bypass by Primary Weakness).

A remote attacker with low privileges can exploit this issue by manipulating the email provided through the IDP during authentication. By controlling or spoofing an IDP identity with an email address matching a target AAP user account, the attacker can link their IDP identity to the victim's account, potentially hijacking it. This grants unauthorized access to the victim's privileges, including administrative accounts if targeted, enabling high-impact confidentiality and integrity violations such as data exfiltration or privilege escalation.

Red Hat has addressed the vulnerability through multiple security errata, including RHSA-2026:13508, RHSA-2026:13512, and RHSA-2026:13545, with additional details available on the CVE page and Bugzilla entry 2458142. Security practitioners should apply these patches promptly to mitigate the risk.

Details

CWE(s)
CWE-305

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1078 Valid Accounts Stealth
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.
attack.mitre.org →
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
Why these techniques?

The flawed email-based auto-link in the AAP gateway (auth bypass via CWE-305) directly enables remote exploitation of a public-facing service (T1190) to hijack existing valid accounts (T1078) without ownership verification; targeting privileged accounts yields privilege escalation (T1068).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

References