CVE-2026-71364: AWX Path Traversal Vulnerability

CVE-2026-71364 Overview

CVE-2026-71364 is a path traversal vulnerability [CWE-22] in Ansible AWX's project archive extraction logic. The project_archive action plugin extracts zip and tar archive members by joining the project directory path with the member filename. The plugin does not perform path normalization, boundary validation, or rejection of directory traversal sequences. An attacker who controls archive content can write files to arbitrary locations on the execution node's filesystem outside the intended project directory.

Critical Impact
Arbitrary file writes as the extracting user can escalate to remote code execution via cron files, SSH authorized_keys, or playbook content injection.

Affected Products

Red Hat Ansible Automation Platform (see Red Hat CVE Report CVE-2026-71364)
AWX project_archive action plugin
Downstream distributions referenced in Red Hat advisories RHSA-2026:59135, RHSA-2026:59136, RHSA-2026:59153, and RHSA-2026:59155

Discovery Timeline

2026-08-24 - CVE-2026-71364 published to the National Vulnerability Database
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-71364

Vulnerability Analysis

The flaw resides in the project_archive action plugin used by AWX to unpack project sources delivered as zip or tar archives. During extraction, the plugin constructs the destination path by concatenating the target project directory with the archive member's stored filename. Because the plugin never canonicalizes the resulting path or verifies it stays within the project root, archive members containing ../ sequences or absolute paths escape the intended directory.

Successful exploitation grants write access to any file the extracting user can modify on the execution node. On typical automation controllers, that user often owns automation runtime artifacts, cron directories, and SSH configuration files. Writing to those targets converts a file-write primitive into remote code execution.

Root Cause

The root cause is missing input validation on archive member names during extraction. The extractor trusts attacker-controlled filenames stored inside the archive header. It does not resolve the joined path with os.path.realpath, does not compare the resolved path against the project directory prefix, and does not reject entries containing .. components or absolute path separators.

Attack Vector

Exploitation requires the attacker to control the archive content ingested by AWX. Three practical vectors exist. First, a compromised upstream source hosting a malicious archive that AWX pulls during project sync. Second, a malicious archive URL configured or injected into a project definition. Third, a man-in-the-middle attack against a plain HTTP archive download that swaps the payload in transit.

Once extraction runs, the crafted archive plants files at paths such as /home/awx/.ssh/authorized_keys, /etc/cron.d/, or existing playbook locations to hijack subsequent automation runs.

No verified public exploit code is available. See the Red Hat Bug Report ID 2511900 for additional technical detail.

Detection Methods for CVE-2026-71364

Indicators of Compromise

Files written outside the AWX project directory tree during or immediately after a project sync operation.
Unexpected modifications to ~/.ssh/authorized_keys, /etc/cron.d/*, or /var/spool/cron/ on execution nodes.
Archive members whose names contain .., absolute paths, or symbolic link references in project sync logs.
Playbook or role files with unexpected content changes not tied to a legitimate source control commit.

Detection Strategies

Enable filesystem auditing on execution nodes with auditd rules covering SSH configuration, cron directories, and the AWX runtime user home directory.
Inspect project sync logs for archive extraction warnings and correlate destination paths against the configured project root.
Alert on outbound project fetches over plain HTTP, which enable man-in-the-middle archive substitution.

Monitoring Recommendations

Monitor process ancestry for shells or interpreters spawned by the AWX service account outside expected automation runs.
Track new or modified cron entries and SSH key additions on all execution nodes with EDR file integrity monitoring.
Review network egress from execution nodes for anomalous connections following project sync events.

How to Mitigate CVE-2026-71364

Immediate Actions Required

Apply the Red Hat updates published in RHSA-2026:59135, RHSA-2026:59136, RHSA-2026:59153, and RHSA-2026:59155.
Audit configured project sources and remove any archive URLs pointing to untrusted or plain HTTP endpoints.
Rotate SSH keys and service credentials on any execution node that ingested archives from a suspect source.

Patch Information

Red Hat has issued fixes for affected Ansible Automation Platform components. Refer to RHSA-2026:59135, RHSA-2026:59136, RHSA-2026:59153, and RHSA-2026:59155 for package versions and rollout instructions. The consolidated vendor entry is available at the Red Hat CVE Report CVE-2026-71364.

Workarounds

Restrict project sources to trusted internal repositories served over HTTPS with certificate validation enabled.
Run AWX execution nodes under least-privilege service accounts with no write access to cron or SSH directories.
Isolate execution nodes on a network segment that blocks outbound HTTP and enforces TLS interception policies.

bash

# Configuration example
# Enforce HTTPS-only project sources and audit sensitive paths on execution nodes

# 1. auditd rules to detect exploitation attempts
echo '-w /root/.ssh/authorized_keys -p wa -k awx_path_traversal' >> /etc/audit/rules.d/awx.rules
echo '-w /etc/cron.d/ -p wa -k awx_path_traversal' >> /etc/audit/rules.d/awx.rules
echo '-w /var/spool/cron/ -p wa -k awx_path_traversal' >> /etc/audit/rules.d/awx.rules
augenrules --load

# 2. Block plain HTTP egress from execution nodes
iptables -A OUTPUT -p tcp --dport 80 -m owner --uid-owner awx -j REJECT