CVE-2026-16544
Awaiting Analysis Awaiting Analysis - Queue

Unauthorized WebSocket Event Access in AWX

Publication date: 2026-07-22

Last updated on: 2026-07-22

Assigner: Red Hat, Inc.

Description
A flaw was found in AWX. The websocket event consumer performs RBAC authorization checks only for event groups that are mapped in the consumer_access() function (job_events, workflow_events, ad_hoc_command_events). Three event groups - inventory_update_events, project_update_events, and system_job_events — are not mapped, causing the authorization check to be skipped. Any authenticated user can subscribe to these unmapped websocket event groups for any object ID and receive real-time stdout output from jobs belonging to organizations they have no access to. This is an incomplete remediation of CVE-2020-10698.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-22
Last Modified
2026-07-22
Generated
2026-08-11
AI Q&A
2026-07-22
EPSS Evaluated
2026-08-10
NVD
CVE-2026-16544
EUVD
EUVD-2026-47629

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
redhat awx 24.6.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in AWX allows any authenticated user to subscribe to websocket event groups that are not properly checked for RBAC permissions. The EventConsumer component skips authorization for inventory_update_events, project_update_events, and system_job_events, letting users receive real-time data from jobs they shouldn't access. This is an incomplete fix for a previous CVE.

Detection Guidance

To detect this vulnerability, check if your AWX instance is running a vulnerable version (e.g., 24.6.1 or devel branch). Inspect the websocket event consumer logs for unauthorized subscription attempts to inventory_update_events, project_update_events, or system_job_events. Monitor network traffic for websocket connections to these unmapped event groups.

Impact Analysis

An attacker could access sensitive job output, including stdout and credentials like SCM basic-auth details, from other organizations. Since object IDs are sequential and guessable, exploitation is straightforward for any authenticated user.

Compliance Impact

This flaw could lead to unauthorized access to sensitive data, violating GDPR's data protection principles or HIPAA's confidentiality requirements. Exposure of credentials or job outputs may result in compliance breaches.

Mitigation Strategies

Apply the latest AWX patches or updates that address this issue. Temporarily disable websocket event subscriptions for the affected event groups if patches are unavailable. Review and restrict user permissions to ensure only authorized users can access sensitive job outputs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16544. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart