{"id":"CVE-2026-12726","title":"Awx: automation-controller: awx: github webhook second-order ssrf via unvalidated statuses_url exfiltrates pat credential","summary":"A flaw was found in the AWX GitHub webhook integration. When processing GitHub pull_request webhooks, the controller stores the pull_request.statuses_url value from the webhook payload without validating that it points to a trusted GitHu…","severity":"medium","cvss":6.3,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N","cvssSource":"cna","cwe":["CWE-918"],"vendor":"Red Hat","product":"ansible-automation-platform-26/controller-rhel9","affected":["ansible-automation-platform-26/controller-rhel9 (all versions)","ansible-automation-platform-27/controller-rhel9 (all versions)","automation-controller (all versions)"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-06-22T17:08:33.221112Z"},"published":"2026-06-19","updated":"2026-11-05","sourceUpdated":"2026-11-05T17:03:08.222Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-12726","references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-12726"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2490796","label":"RHBZ#2490796"}],"tags":["cve.org"],"epss":0.00326,"epssPercentile":0.25832,"ingestedAt":"2026-11-05T22:38:31.419Z","slug":"CVE-2026-12726","body":"## Overview\n\nA flaw was found in the AWX GitHub webhook integration. When processing GitHub pull_request webhooks, the controller stores the pull_request.statuses_url value from the webhook payload without validating that it points to a trusted GitHub API endpoint. If a job template is configured with a GitHub Personal Access Token as its webhook credential, the controller later POSTs that token to the stored callback URL when posting job status updates. An attacker who can submit a correctly signed forged webhook using the job template's webhook_key can redirect the callback to an attacker-controlled URL and exfiltrate the configured GitHub PAT.\n\n## Affected\n\n- `ansible-automation-platform-26/controller-rhel9 (all versions)`\n- `ansible-automation-platform-27/controller-rhel9 (all versions)`\n- `automation-controller (all versions)`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n### Workarounds\n\nThe following practices may reduce exposure to this flaw until a fix is available:\n1. Restrict network access to controller webhook endpoints so only trusted GitHub egress IPs or an approved reverse proxy can reach them.\n2. Protect job template webhook keys as secrets; restrict Job Template admin access; rotate webhook keys if compromise is suspected.\n3. If commit status callback to GitHub is not required, configure GitHub webhooks without a webhook_credential on the job template (this disables PAT transmission on job completion).\n4. Monitor controller logs and outbound connections for unexpected callback destinations following webhook-triggered jobs.","depth":"sunlit","depthScore":35,"depthScoreParts":{"impact":34.7,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}