CVE-2026-16544 in Ansible Automation Platform
Summary
by MITRE • 07/22/2026
A flaw was found in AWX. The websocket event consumer performs RBAC authorization checks only for event groups that are mapped in the consumer_access() function (job_events, workflow_events, ad_hoc_command_events). Three event groups - inventory_update_events, project_update_events, and system_job_events — are not mapped, causing the authorization check to be skipped. Any authenticated user can subscribe to these unmapped websocket event groups for any object ID and receive real-time stdout output from jobs belonging to organizations they have no access to. This is an incomplete remediation of CVE-2020-10698.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability exists within the AWX platform's websocket event handling mechanism, representing a critical authorization bypass flaw that undermines the system's role-based access control framework. The issue stems from an incomplete implementation where the consumer_access() function only maps specific event groups for RBAC validation while leaving three critical event types unauthenticated. The missing event groups inventory_update_events, project_update_events, and system_job_events bypass authorization checks entirely, creating a pathway for unauthorized information disclosure through real-time websocket connections.
The technical flaw manifests in the websocket consumer's design where it fails to validate user permissions against objects associated with these three unmapped event types. When authenticated users subscribe to these specific websocket channels, they can receive immediate stdout output from jobs and system operations that belong to organizations they should not have access to. This represents a direct violation of the principle of least privilege and demonstrates a classic authorization gap in the application's security architecture.
The operational impact of this vulnerability is severe as it allows malicious actors or compromised authenticated users to gain unauthorized visibility into sensitive system operations, inventory updates, project modifications, and system jobs across organizations they shouldn't access. This real-time information disclosure capability significantly increases the attack surface and can lead to data exfiltration, system reconnaissance, and potential lateral movement within the AWX environment. The vulnerability essentially creates a backdoor for privileged information access that bypasses normal access controls.
This issue constitutes an incomplete remediation of CVE-2020-10698, indicating that previous security fixes were not comprehensive enough to address all affected websocket event groups. The vulnerability aligns with CWE-284 Access Control Issues and can be categorized under ATT&CK technique T1078 Valid Accounts for maintaining persistent access. Organizations using AWX should immediately implement mitigations including patching to ensure all websocket event groups are properly mapped in the consumer_access() function, implementing additional authorization checks for these three specific event types, and monitoring websocket connections for suspicious activity patterns.
The root cause of this vulnerability demonstrates a common security pattern where incomplete security implementations leave gaps that can be exploited by attackers. This flaw specifically relates to improper access control enforcement in distributed systems where real-time communication channels require the same rigorous authorization checks as traditional API endpoints. The fix requires ensuring that all websocket event consumers undergo proper RBAC validation regardless of the event type being consumed, preventing unauthorized access to sensitive operational data through the websocket interface.