CVE-2026-16544 Overview
CVE-2026-16544 is a missing authorization vulnerability [CWE-862] in Ansible AWX. The flaw exists in the WebSocket event consumer, which enforces Role-Based Access Control (RBAC) checks only for event groups mapped in the consumer_access() function. Three event groups (inventory_update_events, project_update_events, and system_job_events) are not mapped, so the authorization check is skipped. Any authenticated user can subscribe to these unmapped WebSocket event groups for any object ID. Subscribers then receive real-time stdout output from jobs belonging to organizations they do not have access to. This vulnerability represents an incomplete remediation of CVE-2020-10698.
Critical Impact
Authenticated AWX users can read live job output from inventory updates, project updates, and system jobs across organizational boundaries, exposing sensitive credentials, source repository data, and internal infrastructure details.
Affected Products
- Ansible AWX (WebSocket event consumer component)
- Red Hat Ansible Automation Platform (downstream)
- Deployments dependent on AWX RBAC for tenant isolation
Discovery Timeline
- 2026-07-22 - CVE-2026-16544 published to the National Vulnerability Database
- 2026-07-22 - Last updated in NVD database
Technical Details for CVE-2026-16544
Vulnerability Analysis
AWX streams job execution output to the browser using Django Channels WebSockets. When a client subscribes to an event group, the consumer validates whether the authenticated user has RBAC access to the underlying object. The consumer_access() function maps event group names to permission-check callables and executes them before delivering events.
The mapping table only covers job_events, workflow_events, and ad_hoc_command_events. Subscriptions to inventory_update_events, project_update_events, and system_job_events bypass the check entirely because the lookup returns no handler. The consumer then defaults to permitting the subscription rather than denying it.
Root Cause
The root cause is a default-allow behavior in the authorization dispatcher combined with an incomplete event group map. The remediation for CVE-2020-10698 added checks for job and workflow events but failed to enumerate the remaining event groups that transmit sensitive stdout data. This is a classic missing authorization defect [CWE-862].
Attack Vector
An authenticated low-privilege user establishes a WebSocket session to the AWX server and sends a subscription message referencing one of the unmapped event groups with an arbitrary object ID. The server begins forwarding live event payloads for that object without verifying organization membership or object-level permissions. Attackers can enumerate object IDs to harvest output from inventory syncs, SCM project updates, and internal system jobs across tenants.
The vulnerability manifests entirely in the event consumer authorization logic. See the Red Hat CVE-2026-16544 Advisory and Red Hat Bugzilla Report #2506053 for the upstream analysis.
Detection Methods for CVE-2026-16544
Indicators of Compromise
- WebSocket subscription frames referencing inventory_update_events, project_update_events, or system_job_events from user sessions that lack RBAC access to the referenced object IDs.
- Sequential enumeration of object IDs within a short window on the /websocket/ endpoint.
- Access to job stdout data by users whose audit logs show no corresponding API reads of the parent inventory, project, or system job.
Detection Strategies
- Enable AWX activity stream logging and correlate WebSocket subscription events with RBAC role assignments to surface cross-tenant reads.
- Inspect reverse proxy or ingress logs (nginx, HAProxy) for repeated WebSocket upgrade requests from single accounts spanning many object IDs.
- Deploy application-layer rules that alert when a subscription group name does not appear in the sanctioned consumer map.
Monitoring Recommendations
- Forward AWX and Django Channels logs to a centralized SIEM and alert on anomalous subscribe messages per user.
- Baseline normal per-user job event subscription patterns and flag deviations, particularly bursts targeting system_job_events.
- Monitor authentication events for low-privilege accounts that suddenly access WebSocket endpoints outside of typical UI workflows.
How to Mitigate CVE-2026-16544
Immediate Actions Required
- Apply the AWX security update referenced in the Red Hat CVE-2026-16544 Advisory as soon as a fixed build is available for your channel.
- Rotate any credentials, SCM tokens, or vault secrets that may have been exposed through inventory or project update stdout streams.
- Audit AWX user accounts and disable inactive or shared low-privilege users that could be leveraged for cross-tenant reads.
Patch Information
Refer to the Red Hat CVE-2026-16544 Advisory and Red Hat Bugzilla Report #2506053 for authoritative fixed version information. The fix extends the consumer_access() mapping to enforce RBAC checks on inventory_update_events, project_update_events, and system_job_events, and changes the default to deny unmapped groups.
Workarounds
- Restrict AWX access to trusted networks using firewall rules or an authenticating reverse proxy until the patch is applied.
- Reduce the number of authenticated users with any AWX access to minimize the pool of accounts that can abuse the WebSocket endpoint.
- Place a reverse proxy rule that blocks WebSocket subscribe frames referencing inventory_update_events, project_update_events, or system_job_events if inspection is available.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
