CVE-2026-71366: Server-Side Request Forgery (SSRF) in Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8

This SSRF vulnerability in Red Hat Ansible Automation Platform 2.5 for RHEL 8 affects multiple AWX notification backends by allowing notification template URLs to be used as direct HTTP request targets without validating against private or loopback IP ranges. An attacker with notification administrator privileges can create templates that cause the AWX control node to issue HTTP requests to internal services not externally accessible. The webhook backend exacerbates the risk by following HTTP redirects and resending Basic Authentication credentials to redirected hosts regardless of host changes, enabling credential exfiltration. The Grafana backend sends its API key in the Authorization header to the configured URL, exposing sensitive credentials. Red Hat advises restricting notification template creation to trusted administrators and applying network egress filtering until the update is applied. A security update fixing this vulnerability is available.

An attacker with notification administrator privileges can exploit this SSRF vulnerability to make the AWX control node send HTTP requests to internal or loopback network services that are otherwise inaccessible externally. This can be used to probe internal infrastructure or exfiltrate sensitive credentials. The webhook backend's behavior of following redirects and resending Basic Authentication credentials can lead to credential leakage to attacker-controlled hosts. The Grafana backend exposes its API key to the configured target URL, risking unauthorized access. The vulnerability has a CVSS 3.1 score of 7.7 (high severity) with a high confidentiality impact but no integrity or availability impact.

Red Hat has released an official security update that fixes this vulnerability and applying this update is the recommended remediation. Until the update is applied, customers should restrict the ability to create and modify notification templates to trusted administrators only. Network egress filtering should be implemented on Automation Controller nodes to block outbound connections to loopback (127.0.0.0/8), private (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), and link-local (169.254.0.0/16) IP ranges. Notification template configurations should be monitored for URLs pointing to internal or unusual addresses. Sensitive credentials such as Basic Authentication and Grafana API keys should not be configured in notification templates until the fix is applied. Existing notification templates should be audited for URLs pointing to internal services.