AWX bulk job launch: read-level permission on an instance group is enough to run jobs on it

Impact

The bulk job launch endpoint (POST /api/v2/bulk/job_launch/) checks only read permission on the requested instance groups, while the ordinary single-job launch path requires use permission on the same field. A principal holding execute on a job template plus read on an instance group - the built-in read-only System Auditor role is sufficient - can therefore place jobs onto execution nodes they were never authorized to use. Where instance groups are the placement boundary between environments, that boundary is gone for the bulk path: jobs land on execution nodes with those nodes' network reach and credentials, and consume their capacity. For fleets that carve out a dedicated execution group for GPU or otherwise sensitive nodes, this is the control that was supposed to keep unprivileged automation off them.

Who can reach it

Any authenticated automation-controller user who holds execute on a job template and read-level visibility of the target instance group, over the controller's REST API. No administrative role is needed.

What to do

No fixed version is stated in the record - it links the Red Hat CVE page and Bugzilla only. Apply the automation-controller erratum when Red Hat ships it and restart the controller services; the fix is application-side, so no node drain or reboot is involved. Until then, tighten who holds job-template execute permission, and review which roles have read visibility of instance groups that back sensitive execution nodes.

References

Related entries

• Vertiv Avocent UMG-4000 universal management gateway: An authenticated admin can plant a maliciously named fileCVE-2019-9508 · Vertiv Avocent UMG-4000 universal management gatewayMedium
• Slurm (openSUSE slurm-testsuite packaging): The openSUSE slurm testsuite package ships files with permissive defaultCVE-2022-31251 · Slurm (openSUSE slurm-testsuite packaging)Medium
• Cisco UCS Central Software (weak backup encryption): Weak encryption on full-state and configuration backups meansCVE-2024-20280 · Cisco UCS Central Software (weak backup encryption)Medium
• Dell OpenManage Enterprise (credential disclosure): A low-privileged local user obtains stored credentials from OMECVE-2024-28961 · Dell OpenManage Enterprise (credential disclosure)Medium
• Grafana: org admin can delete other organizations' snapshots and recover delete keys from share keysCVE-2026-19197 · Grafana (dashboard snapshot API)Medium
• CZ.NIC BIRD Internet Routing Daemon (BGP AS_PATH mask matching): Stack-based buffer overflow in BIRD's AS_PATH maskCVE-2026-49943 · CZ.NIC BIRD Internet Routing Daemon (BGP AS_PATH mask matching)Medium