AWX: template admin can attach another user's webhook token and have it sent to a destination they control

Impact

When a job template or workflow job template is assigned a webhook_credential, AWX does not check that the caller has use permission on that credential. A user who administers their own template can therefore attach someone else's webhook token, for example a GitLab personal access token. A later webhook event makes AWX decrypt that token and send it in a request header to a status URL taken from the event payload, which the attacker can influence. The attacker ends up holding the victim's token and can do whatever it permits, which in an automation controller that configures fleet nodes can include pushing to infrastructure repositories.

Who can reach it

An authenticated AWX/AAP user who can administer a job template or workflow job template and use its project and inventory, over the network. They also need to trigger or influence a webhook event.

What to do

Apply the Red Hat Ansible Automation Platform 2 update listed in the Red Hat advisory. The record names no fixed version. In the meantime, audit the webhook_credential assignments on templates and rotate any tokens attached to templates whose administrators should not have them.

References

Related entries

• AAP Gateway Operator: resource-server secret copied in plaintext into the AutomationController custom resourceCVE-2026-126643 · Red Hat Ansible Automation Platform Gateway Operator (AutomationController reconciliation)Medium
• GitLab: group milestones API returns private-project milestone metadata without membershipCVE-2026-13319 · GitLab CE/EE group milestones API (project filter authorization)Medium
• GitLab CE/EE: malformed CSV import lets an authenticated user stall Sidekiq workersCVE-2026-1403 · GitLab CE/EE (CSV import, Sidekiq worker)Medium
• PostgreSQL pgcrypto: PGP functions emit recoverable cleartext when OpenSSL disables the cipherCVE-2026-14663 · PostgreSQL pgcrypto (pgp_sym_encrypt / pgp_pub_encrypt family)Medium
• Grafana: read-only Git Sync users can change a connection's configuration via its status subresourceCVE-2026-15577 · Grafana Git Sync provisioning (connection status subresource)Medium
• Keycloak: authenticated user can exhaust server memory via unbounded Prometheus metric labelsCVE-2026-16100 · Keycloak (user-event Prometheus metrics)Medium