A vulnerability exists in Red Hat Ansible Automation Platform 2 where the AWX GitHub webhook integration improperly trusts the pull_request.statuses_url value from webhook payloads without validation. When a job template is configured with a GitHub Personal Access Token as the webhook credential, the controller posts job status updates including the token to the stored callback URL. An attacker who can submit a correctly signed forged webhook using the job template's webhook_key can exploit this to redirect the callback to a malicious URL and exfiltrate the GitHub PAT. The CVSS v3.1 base score is 6.3 (medium severity), reflecting network attack vector, high attack complexity, low privileges required, no user interaction, scope change, and high confidentiality impact.

Successful exploitation allows an attacker to exfiltrate the GitHub Personal Access Token configured in the job template by redirecting job status update callbacks to an attacker-controlled URL. This compromises the confidentiality of the token, potentially enabling unauthorized access to GitHub resources associated with the token. There is no impact on integrity or availability reported.

Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-12726 for current remediation guidance. Until an official fix is available, avoid configuring job templates with GitHub Personal Access Tokens as webhook credentials or restrict webhook usage to trusted sources. Monitor Red Hat's advisory for updates and apply patches promptly once released.