CVE-2026-71365: AWX Webhook SSRF Vulnerability

CVE-2026-71365 Overview

CVE-2026-71365 is a Server-Side Request Forgery (SSRF) vulnerability in Ansible AWX's webhook status callback mechanism. AWX extracts the pull_request.statuses_url field from incoming GitHub webhook payloads and later uses it to send authenticated status updates. The application does not validate that the target host matches the expected Git provider. An authenticated user with the admin role on a webhook-enabled job template can read the template's webhook signing key, forge a signed GitHub webhook payload with an arbitrary statuses_url, and force AWX to issue POST requests to attacker-controlled or internal endpoints. Because the outbound request carries the configured Git Personal Access Token (PAT) in the Authorization header, exploitation results in credential disclosure.

Critical Impact
An authenticated admin on a webhook-enabled job template can leak the configured Git Personal Access Token to an arbitrary URL and reach internal AWX network resources through forged webhook callbacks.

Affected Products

Ansible AWX (webhook-enabled job templates using GitHub webhook integration)
Red Hat Ansible Automation Platform components that embed AWX
Deployments configured with a Git Personal Access Token for status callbacks

Discovery Timeline

2026-08-18 - CVE-2026-71365 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-71365

Vulnerability Analysis

The flaw resides in how AWX processes GitHub pull request webhooks. When a webhook arrives, AWX reads pull_request.statuses_url from the JSON payload and persists it in the resulting job's extra variables. After the associated job template runs, AWX issues an HTTP POST to that stored URL, attaching the pre-configured Git PAT in the Authorization header to report build status back to GitHub.

AWX performs signature verification on the inbound webhook using the template's HMAC secret, but it treats a valid signature as sufficient proof that the payload's URLs are trustworthy. No allowlist, host validation, or scheme restriction is applied to statuses_url before it is used as the callback target. This weakness is classified as [CWE-918] Server-Side Request Forgery.

Exploitation additionally requires that the attacker obtain the webhook signing key. AWX exposes this key to users holding the admin role on the job template, which turns the SSRF into a viable credential exfiltration primitive rather than an unauthenticated network attack.

Root Cause

The root cause is missing input validation on a URL field controlled by remote payloads. AWX trusts the statuses_url value returned by GitHub because inbound webhooks are HMAC-signed, but signature verification only proves the sender knows the shared secret. It does not constrain the value of URL fields inside the payload. Any admin who can read the secret can produce a valid signature over arbitrary content.

Attack Vector

An attacker with admin permissions on a webhook-enabled job template performs the following steps. They read the webhook signing key from the template settings. They craft a GitHub pull request webhook payload where pull_request.statuses_url points to an attacker-controlled server or an internal AWX address such as the metadata service or a private management API. They compute a valid HMAC signature over the payload using the stolen key and submit it to the AWX webhook endpoint. AWX accepts the payload, launches the associated job, and later POSTs the status update, including the Git PAT, to the attacker-specified URL. The Git PAT can then be reused to access source repositories with the token's granted scopes.

See the Red Hat CVE-2026-71365 Advisory for vendor-supplied technical detail.

Detection Methods for CVE-2026-71365

Indicators of Compromise

Outbound HTTP POST requests from AWX task or web containers to hosts that are not api.github.com or a configured on-premises Git provider.
AWX job records where extra_vars contain a statuses_url value referencing internal RFC1918 addresses, localhost, 169.254.169.254, or unexpected external domains.
Sudden GitHub PAT usage from IP addresses that do not belong to the AWX deployment, indicating a leaked token is being replayed.
Webhook launches on job templates whose signing key was recently viewed or rotated by an admin account.

Detection Strategies

Alert on egress from AWX components to any destination outside an allowlist of approved Git provider endpoints.
Parse AWX job extra_vars and flag records where statuses_url does not match the expected Git provider hostname pattern.
Correlate audit events for webhook key access with subsequent webhook launches on the same template within a short window.

Monitoring Recommendations

Forward AWX application logs, job event data, and container egress telemetry to a centralized analytics platform for correlation.
Enable GitHub audit log streaming and monitor PAT usage patterns, especially requests originating outside known AWX network ranges.
Track modifications to job template webhook configuration and admin role assignments on webhook-enabled templates.

How to Mitigate CVE-2026-71365

Immediate Actions Required

Apply the patched AWX release referenced in the Red Hat CVE-2026-71365 Advisory as soon as it is available in your channel.
Rotate all Git Personal Access Tokens configured in AWX credentials, since any prior exposure cannot be undone.
Rotate webhook signing keys on all job templates that use GitHub webhook integration.
Audit which accounts currently hold the admin role on webhook-enabled job templates and remove unneeded privileges.

Patch Information

Red Hat has published tracking under Red Hat Bug Report #2511901. Consult that advisory for the specific fixed versions applicable to Ansible Automation Platform and upstream AWX. The fix enforces host validation on the statuses_url field so that callbacks are restricted to the configured Git provider.

Workarounds

Disable webhook integration on job templates that do not strictly require GitHub status callbacks until the patch is deployed.
Restrict egress from AWX task and web pods to an allowlist that contains only the required Git provider hostnames.
Scope Git Personal Access Tokens to the minimum repositories and permissions needed, reducing the value of a leaked token.
Limit the admin role on webhook-enabled templates to a small, audited set of operators.

bash

# Example NetworkPolicy fragment restricting AWX egress to GitHub only
# Apply with: kubectl apply -f awx-egress-allowlist.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: awx-egress-allowlist
  namespace: awx
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/name: awx
  policyTypes:
    - Egress
  egress:
    - to:
        - ipBlock:
            cidr: 140.82.112.0/20  # GitHub API range - verify current ranges
      ports:
        - protocol: TCP
          port: 443