AWX CVE-2026-71366

Exploitation requires an authenticated account holding the organization notification administrator role within AWX or Red Hat Ansible Automation Platform 2 - this is a specific delegated privilege, not general user or read-only access. The attacker must have permission to create or modify notification templates in at least one organization. For the SSRF vector against internal services, no non-default configuration is required beyond possessing this role; all four vulnerable backends (webhook, Mattermost, Rocket.Chat, Grafana) are affected by the missing URL validation. For the credential exfiltration via redirect, the webhook template must have Basic Authentication credentials configured - templates without stored credentials are not susceptible to credential theft through this path, though SSRF still applies. The Grafana backend exposes its API key whenever a Grafana notification template is configured, regardless of other settings. Limiting factors: requires authenticated access with a specific administrative delegation (PR:L); organizations that prohibit notification template creation by non-superadministrators are not exposed; SSRF impact is bounded by the network reachability of the AWX control node, so air-gapped or strictly egress-filtered deployments face reduced risk.

The CVSS 7.7 score and vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) accurately reflect the attack conditions: low complexity, no user interaction, but requiring an account with the organization notification administrator role. PR:L is the primary limiting factor - this is not an unauthenticated flaw and opportunistic mass exploitation is unlikely absent credential theft or insider threat. The Changed scope (S:C) and High confidentiality impact (C:H) are the operationally dangerous elements: AWX control nodes function as automation hubs with broad internal network reachability, making them high-value SSRF pivots against metadata services (e.g., cloud IMDS at 169.254.169.254), internal APIs, or adjacent infrastructure. The credential exfiltration path introduces a cascading risk where Basic Auth credentials or Grafana API keys stored in notification templates - which may be reused elsewhere - are exposed. No EPSS score was provided in the source intelligence, and neither a CISA KEV listing nor public exploit code is present, suggesting this has not yet been weaponized broadly; however, the attack is conceptually straightforward and well within the capability of any attacker who obtains the requisite role. Even a mid-sized enterprise operating AWX as a central automation hub should treat this as an urgent patch-or-mitigate priority given the control node's privileged network position.

An attacker who holds or has compromised an organization notification administrator account creates a webhook notification template whose target URL is an internal cloud metadata endpoint (e.g., http://169.254.169.254/latest/meta-data/iam/security-credentials/) and triggers a notification event, causing the AWX control node to issue an HTTP GET to that address and potentially expose instance credentials. Alternatively, the attacker configures a webhook template pointing to an internet host under their control that responds with a 302 redirect to a second attacker-controlled host; when the notification fires, AWX follows the redirect and retransmits the configured Basic Auth credentials in the Authorization header to the final destination. No public exploit code has been identified at time of analysis.