CVE-2026-71365 in Ansible Automation Platform
Summary
by MITRE • 08/18/2026
A server-side request forgery (SSRF) vulnerability was found in AWX's webhook status callback mechanism. When processing GitHub pull request webhooks, AWX extracts the status callback URL (pull_request.statuses_url) from the incoming webhook payload without validating the target host against the expected Git provider. This URL is persisted in job extra variables and later used to send authenticated status updates. A user with admin role on a webhook-enabled job template can read the template's webhook signing key, forge a signed GitHub webhook payload with an arbitrary statuses_url, and cause AWX to POST status updates to an attacker-controlled or internal URL. The status update request includes the configured Git Personal Access Token (PAT) in the Authorization header, resulting in credential leakage to the attacker-specified endpoint.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/18/2026
The vulnerability identified as a server-side request forgery within the AWX webhook status callback mechanism represents a critical failure in input validation and access control logic. The core technical flaw lies in how AWX processes incoming GitHub pull request webhooks, specifically during the extraction of the status callback URL from the payload field known as statuses_url. Instead of validating that this target host belongs to the expected Git provider or adhering to a strict allowlist of trusted domains, the system blindly accepts and persists this value into job extra variables for later use. This lack of domain validation allows an attacker with administrative privileges on a webhook-enabled job template to manipulate the destination endpoint where AWX will subsequently send authenticated status updates. The operational impact is severe because it transforms a standard CI/CD integration feature into a vector for credential theft and potential internal network reconnaissance.
An adversary possessing admin role access can exploit this flaw by forging a signed GitHub webhook payload that contains an arbitrary statuses_url pointing to a server under their control or, more dangerously, to an internal service within the organization's private network. When AWX processes this malicious payload, it stores the forged URL and later attempts to POST status updates to it using the Git Personal Access Token configured for the job template. Consequently, the Authorization header containing the sensitive PAT is transmitted directly to the attacker-specified endpoint rather than the legitimate GitHub API. This results in a direct leakage of credentials that possess significant privileges within the version control system, potentially allowing further compromise of source code repositories and associated pipelines.
From a classification perspective, this vulnerability aligns with CWE-918 Server-Side Request Forgery due to the application making requests on behalf of the user without proper validation of the target resource's origin. Furthermore, it relates closely to CWE-200 Exposure of Sensitive Information to an Unauthorized Actor and CWE-798 Use of Hard-coded Credentials if the PAT is considered static or improperly rotated. In terms of attack tactics, this scenario maps to ATT&CK technique T1556.003 Modifying Authentication Process via credential harvesting through SSRF-induced exfiltration. The attacker leverages their existing administrative access not just for lateral movement but specifically to abuse trusted integrations and leak secrets that are typically protected by network boundaries or authentication layers they do not directly possess.
Mitigation strategies must focus on strict input validation and secure configuration practices immediately. Administrators should enforce domain allowlisting for all webhook callback URLs, ensuring that only requests directed at the legitimate Git provider's API endpoints are permitted. Implementing a centralized proxy with egress filtering can also prevent outbound connections to unauthorized hosts from AWX instances. Additionally, rotating any exposed Personal Access Tokens is critical if this vulnerability has been exploited in an environment where admin access was compromised or shared broadly. Future development should implement strict schema validation for webhook payloads and ensure that sensitive headers are never transmitted to unverified destinations, thereby closing the path for credential exfiltration through SSRF vectors.