CVE-2026-71366: Server-Side Request Forgery (SSRF) in Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8

The vulnerability CVE-2026-71366 affects Red Hat Ansible Automation Platform 2.5 for RHEL 8, specifically its AWX notification backends (webhook, Mattermost, Rocket.Chat, Grafana). These backends do not validate notification template URLs against private, loopback, or reserved IP ranges, enabling SSRF attacks where internal or loopback services can be accessed by an attacker with notification administrator privileges. The webhook backend also follows HTTP redirects and resends Basic Authentication credentials to redirected hosts regardless of host changes, risking credential leakage. The Grafana backend sends its API key in the Authorization header to the target URL, which could be exploited. Red Hat has issued security advisories and patches addressing this vulnerability as part of an important security update for Ansible Automation Platform 2.5 and 2.6.

An attacker with notification administrator privileges can exploit this SSRF vulnerability to make the AWX control node send HTTP requests to internal or loopback network services that are not externally accessible. This can lead to unauthorized access to internal resources. Additionally, the webhook backend's behavior of following redirects and resending Basic Authentication credentials can result in credential leakage to attacker-controlled hosts. The Grafana backend's transmission of API keys in the Authorization header to configured URLs further increases the risk of credential exposure. The CVSS score of 7.7 (high severity) reflects the potential for high confidentiality impact without affecting integrity or availability.

Red Hat has released official security updates addressing CVE-2026-71366 for Red Hat Ansible Automation Platform 2.5 and 2.6. Users should apply these updates promptly to remediate the SSRF and credential leakage vulnerabilities. For detailed instructions, refer to the Red Hat advisory RHSA-2026:59135 and the Ansible Automation Platform documentation. No additional mitigation steps are indicated by the vendor advisory beyond applying the provided patches.