CVE-2026-71366
Awx: notification backends allow ssrf and credential leakage
A server-side request forgery (SSRF) vulnerability was found in multiple AWX notification backends. The webhook, Mattermost, Rocket.Chat, and Grafana notification backends use notification template URLs as direct HTTP request targets without validating the target address against private, loopback, or reserved IP ranges. An organization notification administrator can create notification templates pointing to internal or loopback addresses, causing the AWX control node to issue HTTP requests to services that are not externally accessible. Additionally, the webhook notification backend follows HTTP redirects and resends configured Basic Authentication credentials to redirect targets regardless of host change, allowing an attacker to exfiltrate notification credentials by redirecting to an attacker-controlled host. The Grafana backend sends its API key in the Authorization header to the configured target URL.
Fixes and workarounds
Workaround
There is no complete mitigation for this vulnerability other than applying the update when available. However, the following measures reduce exposure: 1. Restrict the ability to create and modify notification templates to trusted administrators who have legitimate need for this capability. 2. Implement network egress filtering on the Automation Controller nodes to block outbound connections to loopback (127.0.0.0/8), private (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), and link-local (169.254.0.0/16) address ranges. 3. Monitor notification template configurations for URLs pointing to internal or unusual addresses. 4. Avoid configuring sensitive credentials (Basic Auth, Grafana API keys) in notification templates until the fix is applied. Use notification backends that do not require credentials where possible. 5. Review and audit existing notification templates for URLs pointing to internal services.
Source: CNA: redhatAffected products and versions
| Product | Versions | Authority |
|---|---|---|
| Red Hat Ansible Automation Platform 2.5 for RHEL 8 Red Hat automation-controller
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:4.6.32-1.el8ap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat Ansible Automation Platform 2.5 for RHEL 9 Red Hat automation-controller
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:4.6.32-1.el9ap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat Ansible Automation Platform 2.6 for RHEL 9 Red Hat automation-controller
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:4.7.16-1.el9ap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat Ansible Automation Platform 2.6 Red Hat ansible-automation-platform-26/controller-rhel9
https://catalog.redhat.com/software/containers/ |
≥ 1787244009; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat Ansible Automation Platform 2.7 Red Hat ansible-automation-platform-27/controller-rhel9
https://catalog.redhat.com/software/containers/ |
≥ 1787220257; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
Version ranges are source assertions. Check the vendor advisory and your installed configuration before determining exposure.
CVSS assessments
| Version / score | Vector | Authority |
|---|---|---|
| 3.1 / 7.7 high |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N | CNA: redhat |
Exploit evidence
No exploit evidence in collected sources. This is not proof of no exploitation.
References
- https://access.redhat.com/errata/RHSA-2026:59135CNA: redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:59136CNA: redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:59153CNA: redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:59155CNA: redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2026-71366CNA: redhat · vdb-entry, x_refsource_REDHAT
- https://bugzilla.redhat.com/show_bug.cgi?id=2511902CNA: redhat · issue-tracking, x_refsource_REDHAT
For agents and automation
Read public disclosures for free as Markdown or JSON. Compatible browsers also expose native WebMCP tools to search disclosures, read this page, and discover API access.
Use the ontology-linked Cyber API with x402 pay per request, or a Y2 Pro or Elite API key with the intel:cyber scope.
Endpoints and access details
https://api.y2.dev/api/v2/cyber/cveshttps://api.y2.dev/api/v2/cyber/cves/{cveId}
A workspace owner or admin can create a Pro or Elite API key. Send Authorization: Bearer <Y2_API_KEY> from your trusted agent runtime.
For x402, omit Authorization and read the HTTP 402 payment challenge before signing a retry. Public browser tools do not make payments.