Vulnerability in AWX Debug API Endpoints Allows Resource Exhaustion
CVE-2026-71363

5.3MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Ansible Automation Platform 2
Vendor
CVE Published:
12 November 2026

What is CVE-2026-71363?

A security flaw exists in AWX where the debug API endpoints, specifically /api/debug/task_manager/, /api/debug/dependency_manager/, and /api/debug/workflow_manager/, are improperly configured with AllowAny permission. This oversight permits unauthenticated remote attackers to invoke scheduler operations without restriction, resulting in the potential for resource exhaustion through repeated database advisory locks and open transactions. Such exploitation can severely degrade service availability, affecting the overall performance and reliability of the application.

References

https://access.redhat.com/security/cve/CVE-2026-71363
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2511899
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.