CVE-2023-3971High· 7.3▾ MidnightPoC availableAn HTML injection flaw was found in Controller in the user interface settings. This flaw allows an attacker to capture credentials by creating a custom login page by injecting HTML, resulting in a complete compromise.
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 40.2 · likelihood 0.2 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.8%
1 GitHub repo (last check)
An HTML injection flaw was found in Controller in the user interface settings. This flaw allows an attacker to capture credentials by creating a custom login page by injecting HTML, resulting in a complete compromise.
automation-controller (all versions)automation-controller (all versions)automation-controller (all versions)automation-controller (all versions)Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2024-6840Medium· 6.6Automation-controller: gain access to the k8s api server via job execution with container group
CVE-2026-71365High· 7.7Awx: webhook status callback ssrf leaks the git pat
CVE-2026-71364High· 7.2A path traversal vulnerability was found in AWX's project archive extraction
CVE-2026-71366High· 7.7A server-side request forgery (SSRF) vulnerability was found in multiple AWX notification backends
CVE-2026-84470Medium· 6.4A flaw was found in Ansible Automation Platform's automation-controller (AWX). The Bulk Job Launch API (POST /api/v2/bulk/job_launch/) authorizes the requested instance_groups with only a read-level permission check, whereas the standard…
CVE-2026-84724Medium· 6.6An argument-injection flaw was found in the Ansible Automation Platform automation-controller system-job subsystem