EUVD-2026-61015
GHSA-89hq-rjv2-rxvp
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
PR:L because template admin role is required; S:C and C:H reflect PAT exfiltration enabling access to external Git systems; I:N and A:N as exploitation only reads credentials.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Lifecycle Timeline
2DescriptionCVE.org
A server-side request forgery (SSRF) vulnerability was found in AWX's webhook status callback mechanism. When processing GitHub pull request webhooks, AWX extracts the status callback URL (pull_request.statuses_url) from the incoming webhook payload without validating the target host against the expected Git provider. This URL is persisted in job extra variables and later used to send authenticated status updates. A user with admin role on a webhook-enabled job template can read the template's webhook signing key, forge a signed GitHub webhook payload with an arbitrary statuses_url, and cause AWX to POST status updates to an attacker-controlled or internal URL. The status update request includes the configured Git Personal Access Token (PAT) in the Authorization header, resulting in credential leakage to the attacker-specified endpoint.
AnalysisAI
Credential exfiltration via SSRF in AWX's GitHub webhook status callback affects Red Hat Ansible Automation Platform 2: an attacker holding admin role on a webhook-enabled job template can forge a signed GitHub pull request webhook with an arbitrary statuses_url, causing AWX to POST authenticated status updates - including the configured Git Personal Access Token in the Authorization header - to an attacker-controlled or internal endpoint. The Changed scope (S:C) in the CVSS 7.7 vector reflects that the leaked PAT extends attacker reach beyond AWX to connected Git repositories and any internal services reachable via SSRF. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concurrent conditions: (1) the attacker must hold the admin role on a specific AWX job template - this is an authenticated, low-privilege requirement (CVSS PR:L) but limited to template-level administration, not system-wide AWX admin; (2) that job template must have GitHub webhook integration enabled with a signing key configured, since the signing key is the prerequisite for forging a valid HMAC-signed payload; and (3) a Git Personal Access Token must be configured on the job template, as without a PAT there are no credentials to exfiltrate. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.7 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) accurately models the core threat: network-reachable, low complexity, requiring only job-template admin privileges, with a Changed scope that elevates impact beyond the AWX instance itself. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained job-template admin privileges on an AWX instance - whether through legitimate assignment, credential theft, or account compromise - navigates to a webhook-enabled job template, reads the GitHub webhook signing key, and crafts a forged GitHub pull request webhook JSON payload in which pull_request.statuses_url points to an attacker-controlled HTTPS endpoint. The attacker computes a valid HMAC-SHA256 signature over the payload using the stolen key and submits the webhook to AWX's public webhook receiver. … |
| Remediation | Consult the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-71365 for the specific patched package version; an exact fix version is not independently confirmed from available data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all webhook-enabled job templates in AWX and immediately restrict administrative access to only essential personnel using multi-factor authentication; simultaneously inventory all GitHub Personal Access Tokens configured in AWX and their associated permissions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Credential disclosure in Red Hat Ansible Automation Platform 2.5 and 2.6 allows any authenticated user to retrieve plain
Server-side request forgery in the Red Hat Ansible Automation Platform 2 Controller's HashiCorp Vault credential plugin
Arbitrary file write in pulpcore's FilesystemExport feature allows an authenticated administrator to escape the intended
mTLS authentication bypass in the Red Hat Ansible Automation Platform (AAP) Gateway Envoy proxy allows unauthenticated r
Arbitrary command execution in ansible-core allows an attacker who controls a collection source URI to run commands on a
Local code execution in the Visual Studio Code Ansible (Lightspeed) extension lets a malicious project run arbitrary she
SSRF vulnerabilities in AWX notification backends (webhook, Mattermost, Rocket.Chat, and Grafana) allow an authenticated
Remote code execution in galaxy_ng's legacy role import API (v1) allows an authenticated user controlling a git reposito
Path traversal in AWX's project_archive action plugin allows arbitrary file writes to execution node filesystems outside
Incomplete RBAC authorization in AWX's websocket event consumer exposes real-time job stdout to any authenticated user,
Server-side request forgery in galaxy_ng, the Ansible Galaxy server plugin for Pulp, allows authenticated users holding
Container privilege escalation in Red Hat Ansible Automation Platform 2 allows non-root users within affected container
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today