CVE-2026-71365

Awaiting Analysis Awaiting Analysis - Queue

SSRF in AWX Webhook Status Callback Mechanism

Publication date: 2026-08-18

Last updated on: 2026-08-25

Assigner: redhat-SADP

Description

A server-side request forgery (SSRF) vulnerability was found in AWX's webhook status callback mechanism. When processing GitHub pull request webhooks, AWX extracts the status callback URL (pull_request.statuses_url) from the incoming webhook payload without validating the target host against the expected Git provider. This URL is persisted in job extra variables and later used to send authenticated status updates. A user with admin role on a webhook-enabled job template can read the template's webhook signing key, forge a signed GitHub webhook payload with an arbitrary statuses_url, and cause AWX to POST status updates to an attacker-controlled or internal URL. The status update request includes the configured Git Personal Access Token (PAT) in the Authorization header, resulting in credential leakage to the attacker-specified endpoint.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-25

Generated

2026-09-07

AI Q&A

2026-08-18

EPSS Evaluated

2026-09-06

NVD

CVE-2026-71365

EUVD

EUVD-2026-61015

Affected Vendors & Products

Vendor	Product	Version / Range
redhat	awx	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

CVE-2026-71365 is a Server-Side Request Forgery (SSRF) vulnerability in AWX (Ansible Tower). It occurs in the webhook status callback feature where AWX processes GitHub pull request webhooks. The vulnerability allows an attacker with admin privileges on a webhook-enabled job template to forge a signed webhook payload with a malicious statuses_url. This causes AWX to send authenticated status updates to an attacker-controlled or internal URL, leaking the configured Git Personal Access Token (PAT) in the Authorization header.

Detection Guidance

Monitor outbound network connections from AWX/Ansible Tower nodes, particularly POST requests to unexpected external or internal endpoints. Check logs for job extra variables containing statuses_url values pointing to untrusted hosts. Inspect webhook payloads for forged signed requests with modified statuses_url fields.

Impact Analysis

This vulnerability can lead to credential leakage of Git PATs, allowing attackers to gain unauthorized access to repositories or internal systems. It may also enable attackers to proxy requests to internal services, potentially exposing sensitive data or facilitating further attacks. The impact includes unauthorized data access, service disruption, and potential compliance violations.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR (data protection) and HIPAA (privacy) by exposing sensitive credentials and potentially unauthorized access to personal or health data. Organizations may face legal penalties, reputational damage, and loss of trust due to data breaches resulting from credential leakage.

Mitigation Strategies

Restrict admin access to trusted users only. Use Git credentials with minimal required scopes. Implement network egress filtering on Automation Controller nodes to block outbound connections to non-allowlisted hosts including loopback, private, and link-local addresses. Monitor for unusual outbound connections and rotate Git PAT credentials periodically.

Hi! I’m here to help you understand CVE-2026-71365. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70