CVE-2026-76648
Awaiting Analysis Awaiting Analysis - Queue

Permission Bypass in AWX JobTemplate Copy Functionality

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: redhat-SADP

Description
CopyAPIView (awx/awx/api/generics.py:873) sets permission_classes = (IsAuthenticated,), so DRF's get_object() performs no object-level RBAC. The get() handler (lines 988–991) explicitly guards with request.user.can_access(obj._class_, 'read', obj) — but post() (lines 1001–1010) does not. POST only checks: can_access(model, 'add', create_kwargs_check) can_access(model, 'copy_related', obj) For JobTemplate, can_add (awx/awx/main/access.py:1465–1520) gates on inventory.use_role + project.use_role + execution_environment.read_role — resource-level roles that do not imply read on the source JT — and can_copy_related (1522–1534) checks only credentials.use_role. None of these imply the caller can read the source JT.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-24
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-76648
EUVD
EUVD-2026-85533

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
redhat awx *
red_hat ansible_automation_platform *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Red Hat Ansible Automation Platform Controller (AAP) involves the CopyAPIView class not performing proper object-level RBAC checks during POST requests. While GET requests correctly verify read permissions, POST requests only check for 'add' and 'copy_related' permissions without ensuring the user can read the source Job Template. This allows users with limited permissions to copy Job Templates they cannot read, potentially exposing sensitive data like secrets.

Detection Guidance

Detecting this vulnerability requires checking for unauthorized Job Template copies in Ansible Automation Platform Controller logs. Look for POST requests to /api/v2/job_templates/<id>/copy/ where the user lacks read permissions on the source template. Check audit logs for users performing copy operations without proper RBAC checks.

Impact Analysis

An attacker with limited permissions could exploit this to copy Job Templates they cannot read, gaining access to sensitive information such as plaintext host_config_key and extra_vars fields. The recovered host_config_key may allow unauthorized access to the original Job Template's provisioning callback endpoint, leading to further exploitation or privilege escalation to Admin on the cloned template.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Exposure of secrets like host_config_key and extra_vars fields may result in data breaches, non-compliance with data protection regulations, and potential legal or financial penalties.

Mitigation Strategies

Apply the latest patches from Red Hat for Ansible Automation Platform Controller. Temporarily restrict access to the /api/v2/job_templates/<id>/copy/ endpoint. Review and audit all recent Job Template copies to identify potential unauthorized access. Monitor for unusual activity involving Job Template cloning or secret exposure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-76648. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart