CVE-2026-71366: AWX Notification SSRF Vulnerability

CVE-2026-71366 Overview

CVE-2026-71366 is a server-side request forgery (SSRF) vulnerability affecting multiple notification backends in Ansible AWX. The webhook, Mattermost, Rocket.Chat, and Grafana notification backends accept template URLs and issue HTTP requests without validating the target against private, loopback, or reserved IP ranges. An organization notification administrator can direct the AWX control node to internal services that are not externally reachable. The webhook backend also follows HTTP redirects and forwards Basic Authentication credentials to redirect targets on different hosts, enabling credential exfiltration to attacker-controlled infrastructure. The Grafana backend transmits its API key in the Authorization header to whatever URL is configured.

Critical Impact
An authenticated notification administrator can pivot HTTP requests through the AWX control node into internal networks and exfiltrate configured notification credentials, including Basic Auth secrets and Grafana API keys.

Affected Products

Ansible AWX (upstream project)
Red Hat Ansible Automation Platform (see referenced RHSAs)
AWX notification backends: webhook, Mattermost, Rocket.Chat, and Grafana

Discovery Timeline

2026-08-24 - CVE-2026-71366 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-71366

Vulnerability Analysis

The vulnerability is classified as SSRF [CWE-918]. AWX notification templates let administrators configure a destination URL for outbound notifications. The webhook, Mattermost, Rocket.Chat, and Grafana backends treat the configured URL as a direct HTTP request target. The backends do not validate that the resolved address falls outside private RFC1918 ranges, loopback (127.0.0.0/8), link-local (169.254.0.0/16), or other reserved ranges. An organization notification administrator can therefore coerce the AWX control node into issuing requests to internal cloud metadata endpoints, orchestration APIs, or other services reachable only from the control plane.

A second flaw compounds the SSRF. The webhook notification backend follows HTTP redirects and re-sends the configured Basic Authentication credentials to the redirect target even when the host changes. An attacker who controls the initial endpoint can respond with a 302 to an attacker-owned host and capture the credentials. The Grafana backend independently transmits its API key in the Authorization header to the configured target URL, so pointing it at an attacker-controlled host discloses the key.

Root Cause

The notification backends omit destination validation before performing HTTP requests. The webhook client also delegates redirect handling to the underlying HTTP library without stripping credentials on cross-origin redirects.

Attack Vector

An authenticated user with the organization notification administrator role creates a notification template pointing at an internal URL such as http://127.0.0.1:8052/api/ or a cloud metadata service. Triggering a notification causes the AWX control node to issue the request and, depending on the backend, return response content or timing signals. To steal credentials, the attacker hosts an endpoint that returns an HTTP redirect to an external listener and configures a webhook template with Basic Auth credentials pointing at that endpoint.

No verified public exploit code is available. See the Red Hat CVE-2026-71366 reference for advisory details.

Detection Methods for CVE-2026-71366

Indicators of Compromise

Notification templates configured with URLs resolving to loopback, RFC1918, or link-local address ranges.
Outbound HTTP requests from AWX control nodes to cloud metadata endpoints such as 169.254.169.254.
Webhook notifications terminating at unexpected external hosts following a redirect chain.
Audit log entries showing recent creation or modification of notification templates by non-administrative accounts.

Detection Strategies

Review AWX audit logs for NotificationTemplate create and update events, correlating the configured URL against an allowlist of expected destinations.
Inspect egress proxy or firewall logs for AWX control node traffic destined to internal ranges or unusual external hosts.
Alert on HTTP 3xx responses returned to AWX notification requests where the redirect target changes host.

Monitoring Recommendations

Forward AWX application and audit logs to a centralized analytics platform and retain notification template change history.
Baseline expected notification destinations per organization and alert on deviations.
Monitor for use of Basic Authentication or Grafana API keys in notification templates where they were not previously configured.

How to Mitigate CVE-2026-71366

Immediate Actions Required

Apply the fixed AWX and Red Hat Ansible Automation Platform packages referenced in the Red Hat advisories.
Audit all existing notification templates for webhook, Mattermost, Rocket.Chat, and Grafana backends and remove any pointing at internal or unexpected URLs.
Rotate any Basic Authentication credentials and Grafana API keys previously configured in webhook or Grafana notification templates.
Restrict the organization notification administrator role to trusted operators.

Patch Information

Red Hat has published fixes in RHSA-2026:59135, RHSA-2026:59136, RHSA-2026:59153, and RHSA-2026:59155. Additional details are tracked in Red Hat Bugzilla #2511902.

Workarounds

Place AWX control nodes behind an egress proxy that blocks requests to loopback, RFC1918, link-local, and cloud metadata address ranges.
Enforce network segmentation so the AWX control node cannot reach sensitive internal APIs directly.
Remove webhook and Grafana notification templates that carry sensitive credentials until patches are applied.

bash

# Example egress deny rules for the AWX control node (iptables)
iptables -A OUTPUT -d 127.0.0.0/8 -j REJECT
iptables -A OUTPUT -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -d 192.168.0.0/16 -j REJECT
iptables -A OUTPUT -d 169.254.0.0/16 -j REJECT