EUVD-2026-47629
GHSA-2jx7-9fh6-5m74
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
WebSocket subscription is network-reachable with low complexity; PR:L reflects mandatory authentication; C:H for job stdout exfiltration; no integrity or availability impact.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
1DescriptionCVE.org
A flaw was found in AWX. The websocket event consumer performs RBAC authorization checks only for event groups that are mapped in the consumer_access() function (job_events, workflow_events, ad_hoc_command_events). Three event groups - inventory_update_events, project_update_events, and system_job_events - are not mapped, causing the authorization check to be skipped. Any authenticated user can subscribe to these unmapped websocket event groups for any object ID and receive real-time stdout output from jobs belonging to organizations they have no access to. This is an incomplete remediation of CVE-2020-10698.
AnalysisAI
Incomplete RBAC authorization in AWX's websocket event consumer exposes real-time job stdout to any authenticated user, regardless of organizational access controls. Three event group types - inventory_update_events, project_update_events, and system_job_events - are absent from the consumer_access() authorization mapping, causing authorization checks to be silently skipped when users subscribe to these channels for arbitrary object IDs. This is confirmed as an incomplete remediation of CVE-2020-10698, affecting Red Hat Ansible Automation Platform 2. No public exploit or CISA KEV listing is identified at time of analysis.
Technical ContextAI
AWX, the upstream open-source project underlying Red Hat Ansible Automation Platform 2 (CPE: cpe:2.3:a:red_hat:red_hat_ansible_automation_platform_2), uses WebSocket connections to stream real-time job output to users via an event consumer architecture. The consumer_access() function implements RBAC by mapping event group names to authorization logic. CWE-862 (Missing Authorization) is the root cause: the mapping uses an implicit allowlist that covers only job_events, workflow_events, and ad_hoc_command_events. The three unmapped groups - inventory_update_events, project_update_events, and system_job_events - fall through without any authorization check, allowing unrestricted subscription by any authenticated session. This enumeration-gap pattern in authorization logic is a recurring failure mode in event-driven systems where new event types are added without updating security enforcement code.
RemediationAI
Apply the vendor-issued patch from Red Hat for Ansible Automation Platform 2 as detailed in the security advisory at https://access.redhat.com/security/cve/CVE-2026-16544. No specific fixed version number is confirmed from the available reference data - consult the advisory directly for the exact patched release. As a compensating control pending patch application, restrict WebSocket endpoint access at the network or reverse-proxy layer to reduce exposure to only explicitly authorized users or networks; note this degrades real-time UI functionality for all users. Additionally, audit WebSocket event subscription logs for unexpected cross-organization subscriptions to inventory_update_events, project_update_events, or system_job_events channels, which would indicate prior exploitation. Organizations should review whether AWX job stdout contains credentials or sensitive data and evaluate whether secret redaction in playbook output is configured, as this limits the value of any exfiltrated data.
Credential disclosure in Red Hat Ansible Automation Platform 2.5 and 2.6 allows any authenticated user to retrieve plain
Server-side request forgery in the Red Hat Ansible Automation Platform 2 Controller's HashiCorp Vault credential plugin
Arbitrary file write in pulpcore's FilesystemExport feature allows an authenticated administrator to escape the intended
mTLS authentication bypass in the Red Hat Ansible Automation Platform (AAP) Gateway Envoy proxy allows unauthenticated r
Arbitrary command execution in ansible-core allows an attacker who controls a collection source URI to run commands on a
Local code execution in the Visual Studio Code Ansible (Lightspeed) extension lets a malicious project run arbitrary she
Credential exfiltration via SSRF in AWX's GitHub webhook status callback affects Red Hat Ansible Automation Platform 2:
SSRF vulnerabilities in AWX notification backends (webhook, Mattermost, Rocket.Chat, and Grafana) allow an authenticated
Remote code execution in galaxy_ng's legacy role import API (v1) allows an authenticated user controlling a git reposito
Path traversal in AWX's project_archive action plugin allows arbitrary file writes to execution node filesystems outside
Server-side request forgery in galaxy_ng, the Ansible Galaxy server plugin for Pulp, allows authenticated users holding
Container privilege escalation in Red Hat Ansible Automation Platform 2 allows non-root users within affected container
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today