Every CVE Search/ Get API key

CVE-2026-71365

Awx: webhook status callback ssrf leaks the git pat

7.7 High

A server-side request forgery (SSRF) vulnerability was found in AWX's webhook status callback mechanism. When processing GitHub pull request webhooks, AWX extracts the status callback URL (pull_request.statuses_url) from the incoming webhook payload without validating the target host against the expected Git provider. This URL is persisted in job extra variables and later used to send authenticated status updates. A user with admin role on a webhook-enabled job template can read the template's webhook signing key, forge a signed GitHub webhook payload with an arbitrary statuses_url, and cause AWX to POST status updates to an attacker-controlled or internal URL. The status update request includes the configured Git Personal Access Token (PAT) in the Authorization header, resulting in credential leakage to the attacker-specified endpoint.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

0.49%Up 0.1 points since Aug 19, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.7

Awx: webhook status callback ssrf leaks the git pat

A server-side request forgery (SSRF) vulnerability was found in AWX's webhook status callback mechanism. When processing GitHub pull request webhooks, AWX extracts the status callback URL (pull_request.statuses_url) from the incoming webhook payload without validating the target host against the expected Git provider. This URL is persisted in job extra variables and later used to send authenticated status updates. A user with admin role on a webhook-enabled job template can read the template's webhook signing key, forge a signed GitHub webhook payload with an arbitrary statuses_url, and cause AWX to POST status updates to an attacker-controlled or internal URL. The status update request includes the configured Git Personal Access Token (PAT) in the Authorization header, resulting in credential leakage to the attacker-specified endpoint.

Record
CVE-2026-71365
CVSS 3.1
7.7 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Weakness
CWE-918
Updated
2026-11-02
EUVDEUVD-2026-61015 7.7

A server-side request forgery (SSRF) vulnerability was found in AWX's webhook status callback mechanism. When processing GitHub pull request webhooks, AWX extracts the status callback URL (pull_request.statuses_url) from the incoming webhook payload without validating the target host against the expected Git provider. This URL is persisted in job extra variables and later used to send authenticated status updates. A user with admin role on a webhook-enabled job template can read the template's webhook signing key, forge a signed GitHub webhook payload with an arbitrary statuses_url, and cause AWX to POST status updates to an attacker-controlled or internal URL. The status update request includes the configured Git Personal Access Token (PAT) in the Authorization header, resulting in credential leakage to the attacker-specified endpoint.

Record
EUVD-2026-61015
CVSS 3.1
7.7 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Updated
2026-11-05
GitHub AdvisoriesGHSA-89hq-rjv2-rxvp 7.7

A server-side request forgery (SSRF) vulnerability was found in AWX's webhook status callback...

A server-side request forgery (SSRF) vulnerability was found in AWX's webhook status callback mechanism. When processing GitHub pull request webhooks, AWX extracts the status callback URL (pull_request.statuses_url) from the incoming webhook payload without validating the target host against the expected Git provider. This URL is persisted in job extra variables and later used to send authenticated status updates. A user with admin role on a webhook-enabled job template can read the template's webhook signing key, forge a signed GitHub webhook payload with an arbitrary statuses_url, and cause AWX to POST status updates to an attacker-controlled or internal URL. The status update request includes the configured Git Personal Access Token (PAT) in the Authorization header, resulting in credential leakage to the attacker-specified endpoint.

Record
GHSA-89hq-rjv2-rxvp
CVSS 3.1
7.7 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Weakness
CWE-918
Updated
2026-11-02
NVD 7.7

A server-side request forgery (SSRF) vulnerability was found in AWX's webhook status callback mechanism. When processing GitHub pull request webhooks, AWX extracts the status callback URL (pull_request.statuses_url) from the incoming webhook payload without validating the target host against the expected Git provider. This URL is persisted in job extra variables and later used to send authenticated status updates. A user with admin role on a webhook-enabled job template can read the template's webhook signing key, forge a signed GitHub webhook payload with an arbitrary statuses_url, and cause AWX to POST status updates to an attacker-controlled or internal URL. The status update request includes the configured Git Personal Access Token (PAT) in the Authorization header, resulting in credential leakage to the attacker-specified endpoint.

Record
CVE-2026-71365
CVSS 3.1
7.7 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Weakness
CWE-918
Updated
2026-11-05
OSVRHSA-2026:59135 8.8

Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update

Record
RHSA-2026:59135
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:59136 8.8

Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update

Record
RHSA-2026:59136
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
python3.12-django
Red Hat:ansible_automation_platform_developer:2.5::el8
From an advisory covering 18 CVEs
 before 0:5.2.17-1.el8ap
0:5.2.17-1.el8ap
python3.12-django
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 18 CVEs
 before 0:5.2.17-1.el8ap
0:5.2.17-1.el8ap
python3.12-django
Red Hat:ansible_automation_platform_developer:2.5::el9
From an advisory covering 18 CVEs
 before 0:5.2.17-1.el9ap
0:5.2.17-1.el9ap
python3.12-django
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 18 CVEs
 before 0:5.2.17-1.el9ap
0:5.2.17-1.el9ap
automation-controller-venv-tower
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 18 CVEs
 before 0:4.6.32-1.el8ap
0:4.6.32-1.el8ap
automation-controller-venv-tower
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 18 CVEs
 before 0:4.6.32-1.el9ap
0:4.6.32-1.el9ap
automation-gateway-server
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 18 CVEs
 before 0:2.5.20260824-1.el8ap
0:2.5.20260824-1.el8ap
automation-gateway-server
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 18 CVEs
 before 0:2.5.20260824-1.el9ap
0:2.5.20260824-1.el9ap
automation-controller-cli
Red Hat:ansible_automation_platform_developer:2.5::el8
From an advisory covering 18 CVEs
 before 0:4.6.32-1.el8ap
0:4.6.32-1.el8ap
automation-controller-cli
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 18 CVEs
 before 0:4.6.32-1.el8ap
0:4.6.32-1.el8ap
Show 20 moreShow less
Affected packages
PackageAffectedFixed
automation-controller-cli
Red Hat:ansible_automation_platform_developer:2.5::el9
From an advisory covering 18 CVEs
 before 0:4.6.32-1.el9ap
0:4.6.32-1.el9ap
automation-controller-cli
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 18 CVEs
 before 0:4.6.32-1.el9ap
0:4.6.32-1.el9ap
python3.12-gitpython
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 18 CVEs
 before 0:3.1.59-1.el8ap
0:3.1.59-1.el8ap
python3.12-gitpython
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 18 CVEs
 before 0:3.1.59-1.el9ap
0:3.1.59-1.el9ap
python3.12-aiohttp
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 18 CVEs
 before 0:3.14.3-1.el8ap
0:3.14.3-1.el8ap
python3.12-aiohttp
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 18 CVEs
 before 0:3.14.3-1.el9ap
0:3.14.3-1.el9ap
automation-platform-ui
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 20 CVEs
 before 0:2.6.13-1.el9ap
0:2.6.13-1.el9ap
python-django
Red Hat:ansible_automation_platform_developer:2.6::el10
From an advisory covering 20 CVEs
 before 0:5.2.17-1.el10ap
0:5.2.17-1.el10ap
python3-django
Red Hat:ansible_automation_platform_developer:2.6::el10
From an advisory covering 20 CVEs
 before 0:5.2.17-1.el10ap
0:5.2.17-1.el10ap
python-django
Red Hat:ansible_automation_platform:2.6::el10
From an advisory covering 20 CVEs
 before 0:5.2.17-1.el10ap
0:5.2.17-1.el10ap
python3-django
Red Hat:ansible_automation_platform:2.6::el10
From an advisory covering 20 CVEs
 before 0:5.2.17-1.el10ap
0:5.2.17-1.el10ap
python3.12-django
Red Hat:ansible_automation_platform_developer:2.6::el9
From an advisory covering 20 CVEs
 before 0:5.2.17-1.el9ap
0:5.2.17-1.el9ap
python3.12-django
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 20 CVEs
 before 0:5.2.17-1.el9ap
0:5.2.17-1.el9ap
automation-controller-venv-tower
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 20 CVEs
 before 0:4.7.16-1.el9ap
0:4.7.16-1.el9ap
automation-controller-cli
Red Hat:ansible_automation_platform_developer:2.6::el9
From an advisory covering 20 CVEs
 before 0:4.7.16-1.el9ap
0:4.7.16-1.el9ap
automation-controller-cli
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 20 CVEs
 before 0:4.7.16-1.el9ap
0:4.7.16-1.el9ap
python3.12-gitpython
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 20 CVEs
 before 0:3.1.59-1.el9ap
0:3.1.59-1.el9ap
python3.12-aiohttp
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 20 CVEs
 before 0:3.14.3-1.el9ap
0:3.14.3-1.el9ap
python3.12-aiohttp-debuginfo
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 20 CVEs
 before 0:3.14.3-1.el9ap
0:3.14.3-1.el9ap
python3.12-aiohttp-debugsource
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 20 CVEs
 before 0:3.14.3-1.el9ap
0:3.14.3-1.el9ap

History

History
RecordedChangedSources
affected, factsNVD
factsEUVD
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-71365 is a high vulnerability (CVSS 7.7) in Red Hat Ansible Automation Platform 2.5 For Rhel 8, published August 18, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.49%, the 42nd percentile. No source names a fixed version.

References

Show 130 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open