{"id":"CVE-2026-71363","aliases":["EUVD-2026-124562","GHSA-j7wj-xf6p-vhwp"],"status":"published","title":"Awx: unauthenticated debug endpoints trigger scheduler operations","description":"A flaw was found in AWX. The debug API endpoints (/api/debug/task_manager/, /api/debug/dependency_manager/, /api/debug/workflow_manager/) are registered unconditionally in the URL configuration and use AllowAny permission class with _ignore_model_permissions=True. This allows an unauthenticated remote attacker to repeatedly invoke scheduler operations that acquire database advisory locks and open transactions, potentially leading to resource exhaustion and degraded service availability.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-306"],"published":"2026-11-12T17:19:27Z","modified":"2026-11-12T18:32:04Z","products":[{"vendor":"red hat","product":"red hat ansible automation platform 2"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-71363","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2511899","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71363"},{"url":"https://github.com/advisories/GHSA-j7wj-xf6p-vhwp"}],"sources":{"cve":[{"id":"CVE-2026-71363","title":"Awx: unauthenticated debug endpoints trigger scheduler operations","description":"A flaw was found in AWX. The debug API endpoints (/api/debug/task_manager/, /api/debug/dependency_manager/, /api/debug/workflow_manager/) are registered unconditionally in the URL configuration and use AllowAny permission class with _ignore_model_permissions=True. This allows an unauthenticated remote attacker to repeatedly invoke scheduler operations that acquire database advisory locks and open transactions, potentially leading to resource exhaustion and degraded service availability.","status":"published","published":"2026-11-12T17:19:27.585Z","modified":"2026-11-12T17:19:27.585Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-306"],"updated_at":"2026-11-12T18:46:15.330302Z"}],"euvd":[{"id":"EUVD-2026-124562","description":"A flaw was found in AWX. The debug API endpoints (/api/debug/task_manager/, /api/debug/dependency_manager/, /api/debug/workflow_manager/) are registered unconditionally in the URL configuration and use AllowAny permission class with _ignore_model_permissions=True. This allows an unauthenticated remote attacker to repeatedly invoke scheduler operations that acquire database advisory locks and open transactions, potentially leading to resource exhaustion and degraded service availability.","status":"published","published":"2026-11-12T17:19:27Z","modified":"2026-11-12T17:19:27Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-12T20:34:58.221926Z"}],"ghsa":[{"id":"GHSA-j7wj-xf6p-vhwp","title":"A flaw was found in AWX. The debug API endpoints (/api/debug/task_manager/, /api/debug...","description":"A flaw was found in AWX. The debug API endpoints (/api/debug/task_manager/, /api/debug/dependency_manager/, /api/debug/workflow_manager/) are registered unconditionally in the URL configuration and use AllowAny permission class with _ignore_model_permissions=True. This allows an unauthenticated remote attacker to repeatedly invoke scheduler operations that acquire database advisory locks and open transactions, potentially leading to resource exhaustion and degraded service availability.","status":"published","published":"2026-11-12T18:31:54Z","modified":"2026-11-12T18:32:04Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-306"],"updated_at":"2026-11-12T18:42:37.941061Z"}],"nvd":[{"id":"CVE-2026-71363","description":"A flaw was found in AWX. The debug API endpoints (/api/debug/task_manager/, /api/debug/dependency_manager/, /api/debug/workflow_manager/) are registered unconditionally in the URL configuration and use AllowAny permission class with _ignore_model_permissions=True. This allows an unauthenticated remote attacker to repeatedly invoke scheduler operations that acquire database advisory locks and open transactions, potentially leading to resource exhaustion and degraded service availability.","status":"published","published":"2026-11-12T18:17:53.27Z","modified":"2026-11-12T18:17:53.42Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"primary"}],"cwes":["CWE-306"],"updated_at":"2026-11-12T19:32:19.894551Z"}]}}