Server-side Request Forgery Vulnerability in AWX Webhook Mechanism
CVE-2026-71365

7.7HIGH

Key Information:

Vendor

Red Hat
Status
Red Hat Ansible Automation Platform 2
Vendor
CVE Published:
18 August 2026

What is CVE-2026-71365?

A vulnerability in AWX's webhook status callback mechanism allows for server-side request forgery (SSRF). When processing GitHub pull request webhooks, AWX incorrectly extracts the status callback URL from the webhook payload without sufficient validation of the target host. This flaw permits an authenticated user with admin-level access on a webhook-enabled job template to read the webhook signing key and send maliciously crafted GitHub webhook payloads. By providing an arbitrary statuses_url, the attacker can manipulate AWX to post status updates to any endpoint of their choice, potentially exposing sensitive credentials such as the Git Personal Access Token included in the Authorization header.

References

https://access.redhat.com/security/cve/CVE-2026-71365
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2511901
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.