CVE-2026-71366
Received Received - Intake

SSRF in AWX Notification Backends via Unvalidated URLs

Publication date: 2026-08-24

Last updated on: 2026-08-24

Assigner: redhat-SADP

Description
A server-side request forgery (SSRF) vulnerability was found in multiple AWX notification backends. The webhook, Mattermost, Rocket.Chat, and Grafana notification backends use notification template URLs as direct HTTP request targets without validating the target address against private, loopback, or reserved IP ranges. An organization notification administrator can create notification templates pointing to internal or loopback addresses, causing the AWX control node to issue HTTP requests to services that are not externally accessible. Additionally, the webhook notification backend follows HTTP redirects and resends configured Basic Authentication credentials to redirect targets regardless of host change, allowing an attacker to exfiltrate notification credentials by redirecting to an attacker-controlled host. The Grafana backend sends its API key in the Authorization header to the configured target URL.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-24
Last Modified
2026-08-24
Generated
2026-08-24
AI Q&A
2026-08-24
EPSS Evaluated
N/A
NVD
CVE-2026-71366
EUVD
EUVD-2026-64923

Affected Vendors & Products

Showing 8 associated CPEs
Vendor Product Version / Range
ansible awx *
mattermost mattermost *
rocket_chat rocket_chat *
grafana grafana *
awx notification_backend webhook
awx notification_backend mattermost
awx notification_backend rocket_chat
grafana grafana From 2.5 (inc) to 2.6 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a server-side request forgery (SSRF) vulnerability in AWX notification backends. It allows an administrator to configure notification templates pointing to internal or loopback addresses, causing the AWX control node to send HTTP requests to non-externally accessible services. The webhook backend follows redirects and resends Basic Authentication credentials without validating the host, enabling credential exfiltration. The Grafana backend sends its API key to the configured target URL.

Detection Guidance

Monitor outbound HTTP/HTTPS connections from AWX control nodes to internal or loopback addresses. Check notification template configurations for URLs pointing to private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback (127.0.0.0/8), or link-local (169.254.0.0/16) addresses. Review webhook redirects and credential reuse in logs.

Impact Analysis

An attacker with notification template creation privileges could use this to access internal services via the AWX control node. They could also steal credentials by redirecting webhook requests to attacker-controlled hosts. Sensitive data like API keys may be exposed if Grafana notifications are misconfigured.

Compliance Impact

This vulnerability could lead to unauthorized access to internal systems, potentially violating data protection requirements under GDPR or HIPAA. Exposure of credentials or API keys may result in compliance breaches due to unauthorized data access or disclosure.

Mitigation Strategies

Restrict notification template creation to trusted administrators only. Implement network egress filtering to block outbound connections to private, loopback, and link-local IP ranges. Avoid storing sensitive credentials in notification templates. Review existing templates for internal URLs and update AWX to the latest patched versions (2.5 for RHEL 8/9 or 2.6 for RHEL 9/10).

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-71366. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart