Bug 2489127 (CVE-2026-12383)

A flaw was found in the Event-Driven Ansible (EDA) server's external event stream handling. The ExternalEventStreamViewSet has permission_classes=[AllowAny] and authentication_classes=[], delegating mTLS authentication entirely to the gateway proxy layer by reading the Subject HTTP header and comparing it against the expected certificate Distinguished Name (DN). There are two defense-in-depth failures: (1) EDA does not validate that the Subject header actually originated from Envoy's mTLS termination — it trusts whatever value appears in the header, meaning any upstream component or misconfiguration that allows header injection enables authentication bypass; (2) when the Subject header value does not match the expected DN, the 403 error response body includes the expected DN, allowing an attacker to trivially discover the correct value and retry. This is a defense-in-depth weakness that becomes directly exploitable when combined with the gateway header-forwarding flaw (tracked separately). Even if the gateway correctly strips headers, EDA should independently validate mTLS authentication rather than blindly trusting an HTTP header.