ansible-automation-platform-27/controller-rhel9 vulnerabilities
CVEs whose affected-version data names the ansible-automation-platform-27/controller-rhel9 package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
35 CVEsRSS
CVE-2026-71366High· 7.7A server-side request forgery (SSRF) vulnerability was found in multiple AWX notification backends
A server-side request forgery (SSRF) vulnerability was found in multiple AWX notification backends. The webhook, Mattermost, Rocket.Chat, and Grafana notification backends use notification template URLs as direct HTTP request targets wit…
CVE-2026-71364High· 7.2A path traversal vulnerability was found in AWX's project archive extraction
A path traversal vulnerability was found in AWX's project archive extraction. The project_archive action plugin extracts zip and tar archive members by joining the project directory path with the member filename without performing path n…
CVE-2026-71365High· 7.7Awx: webhook status callback ssrf leaks the git pat
A server-side request forgery (SSRF) vulnerability was found in AWX's webhook status callback mechanism. When processing GitHub pull request webhooks, AWX extracts the status callback URL (pull_request.statuses_url) from the incoming web…
CVE-2026-12564Critical· 9.6A flaw was found in the AAP Controller's HashiCorp Vault credential plugin
A flaw was found in the AAP Controller's HashiCorp Vault credential plugin. The kubernetes_auth() function in awx_plugins/credentials/hashivault.py reads the controller pod's Kubernetes service account token and sends it to an attacker-c…
CVE-2026-12726Medium· 6.3Awx: automation-controller: awx: github webhook second-order ssrf via unvalidated statuses_url exfiltrates pat credential
A flaw was found in the AWX GitHub webhook integration. When processing GitHub pull_request webhooks, the controller stores the pull_request.statuses_url value from the webhook payload without validating that it points to a trusted GitHu…