A server-side request forgery (SSRF) vulnerability was found in AWX's webhook status callback mechanism. (CVE-2026-71365)

CVE-2026-71365 is a server-side request forgery vulnerability in AWX's webhook status callback mechanism. AWX processes GitHub pull request webhooks by extracting the status callback URL from the webhook payload without validating the host against the expected Git provider. This URL is stored and later used to send authenticated status updates including the Git PAT in the Authorization header. An attacker with admin privileges on a webhook-enabled job template can read the webhook signing key, forge a signed webhook payload with an arbitrary statuses_url, and cause AWX to send status updates to attacker-controlled or internal endpoints, resulting in credential leakage. Red Hat has issued security advisories and patches for Ansible Automation Platform versions 2.5 and 2.6 to fix this vulnerability.

The vulnerability allows an attacker with admin role on a webhook-enabled job template to leak Git Personal Access Tokens by causing AWX to send authenticated status update requests to arbitrary URLs controlled by the attacker or internal network endpoints. This credential leakage can lead to unauthorized access to Git repositories or other resources accessible with the leaked token. The CVSS v3.1 base score is 7.7 (High), reflecting network attack vector, low attack complexity, required privileges, no user interaction, scope change, and high confidentiality impact.

Red Hat has released official security updates for Ansible Automation Platform versions 2.5 and 2.6 that address this SSRF vulnerability and the associated credential leakage. Users should apply these updates promptly following the vendor's guidance. The vendor advisory indicates that the issue is fixed in these updates. No additional mitigation steps are required beyond applying the official patches.