Authorization Flaw in Red Hat Ansible Automation Platform's AWX Component
CVE-2026-126642

6.5MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Ansible Automation Platform 2
Vendor
CVE Published:
12 November 2026

What is CVE-2026-126642?

An authorization flaw has been identified in the AWX component of Red Hat Ansible Automation Platform, which allows users to attach webhook token credentials without possessing the necessary permissions. This issue arises from insufficient checks when assigning foreign keys for JobTemplate and WorkflowJobTemplate access. As a result, an administrator of a job template can inadvertently expose sensitive tokens, such as GitLab private access tokens, to unauthorized entities. When a webhook event triggers, AWX may relay these tokens to an influenced status URL, compromising the security of user credentials and allowing potential unauthorized actions.

References

https://access.redhat.com/security/cve/CVE-2026-126642
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2571729
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.