CVE-2026-12726 Overview
CVE-2026-12726 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] in the AWX GitHub webhook integration. The controller processes GitHub pull_request webhook payloads and stores the pull_request.statuses_url value without validating that it points to a trusted GitHub API endpoint. When a job template uses a GitHub Personal Access Token (PAT) as its webhook credential, AWX later POSTs that token to the stored callback URL when posting job status updates. An attacker who can submit a correctly signed forged webhook using the job template's webhook_key can redirect the callback to an attacker-controlled URL and exfiltrate the configured PAT.
Critical Impact
Successful exploitation leaks a GitHub Personal Access Token, allowing the attacker to act against repositories the token authorizes.
Affected Products
- AWX (Ansible Web eXecutable) — GitHub webhook integration component
- Red Hat Ansible Automation Platform deployments using AWX
- Job templates configured with GitHub PAT webhook credentials
Discovery Timeline
- 2026-06-19 - CVE-2026-12726 published to NVD
- 2026-06-22 - Last updated in NVD database
Technical Details for CVE-2026-12726
Vulnerability Analysis
The flaw exists in how AWX processes inbound GitHub pull_request webhook events. AWX trusts the pull_request.statuses_url field supplied by the webhook payload and persists it as the callback target for subsequent job status updates. The controller does not verify that the URL belongs to a legitimate GitHub API host such as api.github.com or a configured GitHub Enterprise endpoint.
When the associated job template runs and reports status, AWX issues an HTTP POST to that stored URL. The request includes the GitHub PAT bound to the template as a webhook credential. By steering the callback to an attacker-controlled host, the adversary captures the bearer token in the request headers.
Exploitation requires a valid signature produced with the template's webhook_key. This raises the attack complexity but does not eliminate the risk when keys are exposed through logs, backups, or insider access.
Root Cause
The controller treats user-controllable webhook payload fields as authoritative routing data. There is no allowlist comparing statuses_url against the expected GitHub API origin, which is the hallmark of SSRF [CWE-918].
Attack Vector
The attack proceeds in four stages. First, the attacker obtains or replays a valid webhook_key for a target job template. Second, the attacker crafts a forged pull_request event whose statuses_url points to attacker infrastructure. Third, the attacker signs the payload with the valid key and submits it to the AWX webhook endpoint. Finally, when AWX posts job status updates, the configured GitHub PAT is sent to the attacker's URL.
No authentication on the AWX user interface is required if the webhook_key is known. See the Red Hat CVE-2026-12726 Advisory for additional vendor context.
Detection Methods for CVE-2026-12726
Indicators of Compromise
- Outbound HTTP POST requests from AWX controller hosts to domains other than api.github.com or the configured GitHub Enterprise hostname.
- AWX job records whose stored callback URL host does not match an approved GitHub API endpoint.
- Unexpected GitHub audit log entries showing PAT use from foreign IP addresses shortly after AWX job runs.
Detection Strategies
- Inspect AWX database entries for webhook callback URLs and flag any hostnames outside an allowlist of GitHub API origins.
- Correlate AWX job execution timestamps with egress proxy logs to detect anomalous destinations receiving Authorization headers.
- Alert on pull_request webhook payloads that contain statuses_url values pointing to non-GitHub hosts.
Monitoring Recommendations
- Enable verbose request logging on the AWX controller and forward to a centralized log platform for review.
- Monitor GitHub PAT usage with fine-grained token scoping and short expirations to limit blast radius.
- Track changes to job template webhook credentials and signing keys through configuration audit trails.
How to Mitigate CVE-2026-12726
Immediate Actions Required
- Rotate any GitHub Personal Access Tokens currently configured as AWX webhook credentials.
- Rotate webhook_key values on job templates that accept GitHub webhooks.
- Restrict egress from AWX controller hosts to only the GitHub API endpoints required for operations.
Patch Information
Consult the Red Hat CVE-2026-12726 Advisory and Red Hat Bug Report #2490796 for fixed package versions and update guidance. Apply vendor-supplied patches that enforce validation of the statuses_url field against trusted GitHub API hosts.
Workarounds
- Disable GitHub webhook integration on job templates until patched packages are deployed.
- Replace broad-scope PATs with GitHub fine-grained tokens limited to a single repository and minimal permissions.
- Place AWX behind an egress proxy that only allows requests to api.github.com or the approved GitHub Enterprise host.
# Example egress allowlist using iptables on the AWX controller
iptables -A OUTPUT -p tcp -d api.github.com --dport 443 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 443 -m owner --uid-owner awx -j REJECT
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
