CVE-2026-71365Awx: webhook status callback ssrf leaks the git pat
Updated under an hour ago ()
Does this affect you?
It affects Red Hat Ansible Automation Platform 2.5 for RHEL 8 and 2 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
A server-side request forgery (SSRF) vulnerability was found in AWX's webhook status callback mechanism. When processing GitHub pull request webhooks, AWX extracts the status callback URL (pull_request.statuses_url) from the incoming webhook payload without validating the target host against the expected Git provider. This URL is persisted in job extra variables and later used to send authenticated status updates. A user with admin role on a webhook-enabled job template can read the template's webhook signing key, forge a signed GitHub webhook payload with an arbitrary statuses_url, and cause AWX to POST status updates to an attacker-controlled or internal URL. The status update request includes the configured Git Personal Access Token (PAT) in the Authorization header, resulting in credential leakage to the attacker-specified endpoint.
- CVSS
- 7.7 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
- Weakness (CWE)
- CWE-918
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- redhat
- NVD analysis
- Awaiting Analysis
- Record last updated
- Aug 25, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 redhat:ansible_automation_platform | from 0:4.6.32-1.el8ap not affected | CNA record |
Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 redhat:ansible_automation_platform_developer | from 0:4.6.32-1.el8ap not affected | CNA record |
Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9 redhat:ansible_automation_platform_inside | from 0:4.7.16-1.el9ap not affected | CNA record |
References
- https://access.redhat.com/errata/RHSA-2026:59135vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:59136vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:59153vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:59155vendor-advisory, x-refsource-redhat
- https://access.redhat.com/security/cve/CVE-2026-71365vdb-entry, x-refsource-redhat
- https://bugzilla.redhat.com/show_bug.cgi?id=2511901issue-tracking, x-refsource-redhat
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.