CVE-2026-76648: AWX API Authentication Bypass Vulnerability

CVE-2026-76648 Overview

CVE-2026-76648 is a missing authorization vulnerability [CWE-862] in the AWX CopyAPIView handler located at awx/awx/api/generics.py:873. The endpoint sets permission_classes = (IsAuthenticated,), which causes Django REST Framework's get_object() to skip object-level role-based access control (RBAC). While the get() handler enforces a read permission check on the source object, the post() handler does not. An authenticated user with limited resource roles can copy source objects such as Job Templates that they cannot read.

Critical Impact
Authenticated low-privilege users can copy sensitive AWX objects, including Job Templates, without holding read access on the source, exposing configuration and enabling lateral abuse of automation resources.

Affected Products

Red Hat Ansible Automation Platform (AWX component)
AWX upstream project (CopyAPIView in awx/awx/api/generics.py)
Deployments referenced in Red Hat Security Advisory RHSA-2026:71177

Discovery Timeline

2026-09-23 - CVE-2026-76648 published to the National Vulnerability Database
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-76648

Vulnerability Analysis

The flaw resides in the CopyAPIView class used by AWX to duplicate API resources. The class declares permission_classes = (IsAuthenticated,), so DRF only verifies that the caller has a valid session. Object-level authorization must therefore be enforced in the view handlers themselves.

The get() handler at lines 988–991 correctly calls request.user.can_access(obj._class_, 'read', obj) before returning data about the source object. The post() handler at lines 1001–1010 omits this read check. Instead, it validates only can_access(model, 'add', create_kwargs_check) and can_access(model, 'copy_related', obj).

For JobTemplate, can_add (defined at awx/awx/main/access.py:1465–1520) checks the use_role on the target inventory and project plus the read_role on the execution environment. can_copy_related (lines 1522–1534) checks only credentials.use_role. None of these role checks imply the caller can read the source Job Template being copied.

Root Cause

The root cause is broken access control [CWE-862]. The POST path relies on permissions relevant to constructing a new object rather than permissions on the source object being duplicated. Because a copy operation inherently exposes source configuration to the caller, the missing read check on the source violates the authorization model that get() already enforces.

Attack Vector

An authenticated user with only resource-level roles such as inventory.use_role, project.use_role, execution_environment.read_role, and credentials.use_role can issue a POST to the copy endpoint for a Job Template they cannot read. The API returns a copy of the object, disclosing template configuration including extra variables, playbook references, and linked resources. The scope is Changed because the created copy is owned by the requester and can be further modified or executed within their own role assignments.

No verified public exploit code is available. See the Red Hat Security Advisory RHSA-2026:71177 and Red Hat Bug Report #2519720 for authoritative technical details.

Detection Methods for CVE-2026-76648

Indicators of Compromise

POST requests to AWX copy endpoints such as /api/v2/job_templates/<id>/copy/ from users who have not issued a prior successful GET on the same object.
Creation of Job Templates, Projects, or Inventories owned by users whose role assignments do not include read_role on the referenced source object.
Bursts of copy operations across multiple source object IDs from a single authenticated account.

Detection Strategies

Correlate AWX application logs and audit events to flag copy POST actions where the requester lacks read_role on the source object.
Compare newly created Job Templates against source templates and alert when the actor is not a member of any role granting read on the original.
Baseline normal copy activity per user and alert on statistical outliers in copy volume or breadth of source objects.

Monitoring Recommendations

Ingest AWX API access logs and role assignment changes into a centralized SIEM for continuous review.
Monitor for changes to awx/awx/api/generics.py and related access control modules in custom or forked AWX deployments.
Track privilege drift, particularly grants of use_role on inventories, projects, and credentials that could broaden the blast radius of this issue.

How to Mitigate CVE-2026-76648

Immediate Actions Required

Apply the fixed packages referenced in Red Hat Security Advisory RHSA-2026:71177 to all affected Ansible Automation Platform and AWX deployments.
Audit existing role assignments and remove unnecessary use_role grants on inventories, projects, and credentials.
Review recent copy operations in AWX audit logs and validate that resulting objects were created by users authorized to read the sources.

Patch Information

Red Hat has published fixed packages via RHSA-2026:71177. Additional vendor context is available in the Red Hat CVE Details for CVE-2026-76648 and Red Hat Bug Report #2519720. Upstream AWX users should apply the corresponding fix that adds an explicit can_access(model, 'read', obj) check to the post() handler of CopyAPIView.

Workarounds

Restrict access to AWX copy endpoints at the reverse proxy or ingress layer for user groups that do not require copy functionality.
Minimize assignment of use_role on shared inventories, projects, and credentials until patched packages are deployed.
Increase logging verbosity on AWX API endpoints and review copy activity daily until remediation is confirmed.

bash

# Example: apply Red Hat updates on affected hosts
sudo dnf update -y ansible-automation-platform-* awx*
sudo systemctl restart automation-controller.service