---
id: CVE-2026-12726
title: >-
  Awx: automation-controller: awx: github webhook second-order ssrf via
  unvalidated statuses_url exfiltrates pat credential
summary: >-
  A flaw was found in the AWX GitHub webhook integration. When processing GitHub
  pull_request webhooks, the controller stores the pull_request.statuses_url
  value from the webhook payload without validating that it points to a trusted
  GitHu…
severity: medium
cvss: 6.3
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-918
vendor: Red Hat
product: ansible-automation-platform-26/controller-rhel9
affected:
  - ansible-automation-platform-26/controller-rhel9 (all versions)
  - ansible-automation-platform-27/controller-rhel9 (all versions)
  - automation-controller (all versions)
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-06-22T17:08:33.221112Z'
published: '2026-06-19'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T17:03:08.222Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-12726'
references:
  - url: 'https://access.redhat.com/security/cve/CVE-2026-12726'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2490796'
    label: RHBZ#2490796
tags:
  - cve.org
epss: 0.00326
epssPercentile: 0.25832
ingestedAt: '2026-11-05T22:38:31.419Z'
---

## Overview

A flaw was found in the AWX GitHub webhook integration. When processing GitHub pull_request webhooks, the controller stores the pull_request.statuses_url value from the webhook payload without validating that it points to a trusted GitHub API endpoint. If a job template is configured with a GitHub Personal Access Token as its webhook credential, the controller later POSTs that token to the stored callback URL when posting job status updates. An attacker who can submit a correctly signed forged webhook using the job template's webhook_key can redirect the callback to an attacker-controlled URL and exfiltrate the configured GitHub PAT.

## Affected

- `ansible-automation-platform-26/controller-rhel9 (all versions)`
- `ansible-automation-platform-27/controller-rhel9 (all versions)`
- `automation-controller (all versions)`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

The following practices may reduce exposure to this flaw until a fix is available:
1. Restrict network access to controller webhook endpoints so only trusted GitHub egress IPs or an approved reverse proxy can reach them.
2. Protect job template webhook keys as secrets; restrict Job Template admin access; rotate webhook keys if compromise is suspected.
3. If commit status callback to GitHub is not required, configure GitHub webhooks without a webhook_credential on the job template (this disables PAT transmission on job completion).
4. Monitor controller logs and outbound connections for unexpected callback destinations following webhook-triggered jobs.