Awx: notification backends allow ssrf and credential leakage
Summary
| CVE | CVE-2026-71366 |
|---|---|
| State | PUBLISHED |
| Assigner | redhat |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-08-24 16:17:22 UTC |
| Updated | 2026-08-24 20:17:10 UTC |
| Description | A server-side request forgery (SSRF) vulnerability was found in multiple AWX notification backends. The webhook, Mattermost, Rocket.Chat, and Grafana notification backends use notification template URLs as direct HTTP request targets without validating the target address against private, loopback, or reserved IP ranges. An organization notification administrator can create notification templates pointing to internal or loopback addresses, causing the AWX control node to issue HTTP requests to services that are not externally accessible. Additionally, the webhook notification backend follows HTTP redirects and resends configured Basic Authentication credentials to redirect targets regardless of host change, allowing an attacker to exfiltrate notification credentials by redirecting to an attacker-controlled host. The Grafana backend sends its API key in the Authorization header to the configured target URL. |
Risk And Classification
Primary CVSS: v3.1 7.7 HIGH from [email protected]
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Problem Types: CWE-918 | CWE-918 Server-Side Request Forgery (SSRF)
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Secondary | 7.7 | HIGH | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N |
| 3.1 | CNA | CVSS | 7.7 | HIGH | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N |
CVSS v3.1 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Red Hat | Red Hat Ansible Automation Platform 2.5 For RHEL 8 | unaffected 0:4.6.32-1.el8ap * rpm | Not specified |
| CNA | Red Hat | Red Hat Ansible Automation Platform 2.5 For RHEL 9 | unaffected 0:4.6.32-1.el9ap * rpm | Not specified |
| CNA | Red Hat | Red Hat Ansible Automation Platform 2.6 For RHEL 9 | unaffected 0:4.7.16-1.el9ap * rpm | Not specified |
| CNA | Red Hat | Red Hat Ansible Automation Platform 2 | Not specified | Not specified |
| CNA | Red Hat | Red Hat Ansible Automation Platform 2 | Not specified | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| bugzilla.redhat.com/show_bug.cgi | [email protected] | bugzilla.redhat.com | |
| access.redhat.com/errata/RHSA-2026:59136 | [email protected] | access.redhat.com | |
| access.redhat.com/security/cve/CVE-2026-71366 | [email protected] | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:59135 | [email protected] | access.redhat.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| CNA | 2026-08-06T00:00:00.000Z | Reported to Red Hat. |
| CNA | 2026-08-24T15:00:57.405Z | Made public. |
Workarounds
CNA: There is no complete mitigation for this vulnerability other than applying the update when available. However, the following measures reduce exposure: 1. Restrict the ability to create and modify notification templates to trusted administrators who have legitimate need for this capability. 2. Implement network egress filtering on the Automation Controller nodes to block outbound connections to loopback (127.0.0.0/8), private (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), and link-local (169.254.0.0/16) address ranges. 3. Monitor notification template configurations for URLs pointing to internal or unusual addresses. 4. Avoid configuring sensitive credentials (Basic Auth, Grafana API keys) in notification templates until the fix is applied. Use notification backends that do not require credentials where possible. 5. Review and audit existing notification templates for URLs pointing to internal services.