The vulnerability arises because the websocket event consumer in AWX performs RBAC authorization checks only for event groups mapped in the consumer_access() function (job_events, workflow_events, ad_hoc_command_events). However, three event groups—inventory_update_events, project_update_events, and system_job_events—are not mapped, resulting in skipped authorization checks. Consequently, any authenticated user can subscribe to these unmapped websocket event groups for any object ID and receive real-time stdout output from jobs belonging to organizations they are unauthorized to access. This represents an information disclosure flaw and is a partial fix failure of CVE-2020-10698.

An attacker with authenticated access can bypass RBAC controls for specific websocket event groups and obtain real-time stdout output from jobs in organizations they should not access. This leads to unauthorized information disclosure (confidentiality impact). There is no impact on integrity or availability reported. The CVSS v3.1 score is 6.5 (medium severity), reflecting network attack vector, low complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-16544 for current remediation guidance. No official fix or temporary workaround is explicitly stated in the provided advisory content. Until a fix is available, restrict authenticated user access to trusted users only and monitor for unusual websocket subscriptions if possible.