# CVE-2026-71366: Awx: notification backends allow ssrf and credential leakage

Status: published. Published: 2026-08-24. Updated: 2026-11-04.

A server-side request forgery (SSRF) vulnerability was found in multiple AWX notification backends. The webhook, Mattermost, Rocket.Chat, and Grafana notification backends use notification template URLs as direct HTTP request targets without validating the target address against private, loopback, or reserved IP ranges. An organization notification administrator can create notification templates pointing to internal or loopback addresses, causing the AWX control node to issue HTTP requests to services that are not externally accessible. Additionally, the webhook notification backend follows HTTP redirects and resends configured Basic Authentication credentials to redirect targets regardless of host change, allowing an attacker to exfiltrate notification credentials by redirecting to an attacker-controlled host. The Grafana backend sends its API key in the Authorization header to the configured target URL.

## Remediation

- workaround: There is no complete mitigation for this vulnerability other than applying the update when available. However, the following measures reduce exposure:

1. Restrict the ability to create and modify notification templates to trusted administrators who have legitimate need for this capability.
2. Implement network egress filtering on the Automation Controller nodes to block outbound connections to loopback (127.0.0.0/8), private (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), and link-local (169.254.0.0/16) address ranges.
3. Monitor notification template configurations for URLs pointing to internal or unusual addresses.
4. Avoid configuring sensitive credentials (Basic Auth, Grafana API keys) in notification templates until the fix is applied. Use notification backends that do not require credentials where possible.
5. Review and audit existing notification templates for URLs pointing to internal services. (source: CNA: redhat)

## Affected products and versions

- Red Hat / Red Hat Ansible Automation Platform 2.5 for RHEL 8 (automation-controller): ≥ 0:4.6.32-1.el8ap; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Ansible Automation Platform 2.5 for RHEL 9 (automation-controller): ≥ 0:4.6.32-1.el9ap; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Ansible Automation Platform 2.6 for RHEL 9 (automation-controller): ≥ 0:4.7.16-1.el9ap; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Ansible Automation Platform 2.6 (ansible-automation-platform-26/controller-rhel9): ≥ 1787244009; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Ansible Automation Platform 2.7 (ansible-automation-platform-27/controller-rhel9): ≥ 1787220257; < * (unaffected, rpm). Source: CNA: redhat

## Severity and prioritization

- CVSS 3.1: 7.7 (high); CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N; source: CNA: redhat

- CISA KEV: No listing in collected sources

- EPSS: 0.56% as of 2026-11-04; percentile 46.83%

- SSVC: exploitation none; automatable no; technical impact partial; source ADP: CISA-ADP

- Weaknesses: CWE-918

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://access.redhat.com/errata/RHSA-2026:59135 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:59136 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:59153 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:59155 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/security/cve/CVE-2026-71366 (CNA: redhat; vdb-entry, x_refsource_REDHAT)

- https://bugzilla.redhat.com/show_bug.cgi?id=2511902 (CNA: redhat; issue-tracking, x_refsource_REDHAT)

## Provenance

- CNA: redhat: https://www.cve.org/CVERecord?id=CVE-2026-71366; retrieved 2026-11-05; source updated 2026-11-04

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2026-71366; retrieved 2026-11-05; source updated Not reported

Revision: b2cd9ea9ac448e1e6e985e1c65b5e4d2c8df24b30184f7a3dc4df26608a71a51

Canonical: https://y2.dev/cve/CVE-2026-71366

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.