CVE-2026-71365High· 7.7▾ TwilightA server-side request forgery (SSRF) vulnerability was found in AWX's webhook status callback mechanism. When processing GitHub pull request webhooks, AWX extracts the status callback URL (pull_request.statuses_url) from the incoming web…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 42.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.5%
A server-side request forgery (SSRF) vulnerability was found in AWX's webhook status callback mechanism. When processing GitHub pull request webhooks, AWX extracts the status callback URL (pull_request.statuses_url) from the incoming webhook payload without validating the target host against the expected Git provider. This URL is persisted in job extra variables and later used to send authenticated status updates. A user with admin role on a webhook-enabled job template can read the template's webhook signing key, forge a signed GitHub webhook payload with an arbitrary statuses_url, and cause AWX to POST status updates to an attacker-controlled or internal URL. The status update request includes the configured Git Personal Access Token (PAT) in the Authorization header, resulting in credential leakage to the attacker-specified endpoint.
automation-controller (all versions)automation-controller (all versions)automation-controller (all versions)automation-controller (all versions)automation-controller (all versions)automation-controller (all versions)ansible-automation-platform-26/controller-rhel9 (all versions)ansible-automation-platform-27/controller-rhel9 (all versions)Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
There is no complete mitigation for this vulnerability other than applying the update when available. However, the following measures reduce exposure:
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-71366High· 7.7A server-side request forgery (SSRF) vulnerability was found in multiple AWX notification backends
CVE-2026-71364High· 7.2A path traversal vulnerability was found in AWX's project archive extraction
CVE-2026-52902Medium· 4.7Awxkit: path traversal via yaml !include directive
CVE-2026-12564Critical· 9.6A flaw was found in the AAP Controller's HashiCorp Vault credential plugin
CVE-2024-6840Medium· 6.6Automation-controller: gain access to the k8s api server via job execution with container group
CVE-2024-6538Medium· 5.3A flaw was found in OpenShift Console