Server-Side Request Forgery Vulnerability in AWX Notification Backends by Red Hat
CVE-2026-71366
Key Information:
What is CVE-2026-71366?
A server-side request forgery vulnerability exists in AWX notification backends, including Mattermost, Rocket.Chat, and Grafana. This issue arises when notification template URLs are utilized as direct HTTP request targets without proper validation against internal, loopback, or reserved IP ranges. As a result, notification administrators can craft templates that point to internal resources, enabling the AWX control node to send HTTP requests to services that are normally inaccessible from outside the network. Moreover, the webhook notification backend can follow HTTP redirects, potentially exposing Basic Authentication credentials to an attacker by redirecting to malicious hosts. Additionally, the Grafana notification backend transmits its API key through the Authorization header to designed target URLs, heightening the risk of credential exfiltration.
Affected Version(s)
Red Hat Ansible Automation Platform 2.5 for RHEL 8 0:4.6.32-1.el8ap
Red Hat Ansible Automation Platform 2.5 for RHEL 9 0:4.6.32-1.el9ap
Red Hat Ansible Automation Platform 2.6 1787244009