The SSRF vulnerability in Red Hat Ansible Automation Platform 2 affects multiple AWX notification backends by allowing notification template URLs to be used as direct HTTP request targets without proper validation against private, loopback, or reserved IP ranges. This enables an organization notification administrator to leverage the AWX control node as a proxy to access internal services that are not externally accessible. The webhook notification backend exacerbates the risk by following HTTP redirects and resending Basic Authentication credentials to redirected hosts without host validation, enabling potential credential exfiltration. The Grafana backend exposes its API key in the Authorization header to the configured target URL. This vulnerability is distinct from CVE-2026-71365 and requires different permissions. Red Hat has assessed the impact as important but has not yet provided an official fix. Customers are advised to restrict notification template creation to trusted administrators and implement network egress filtering to mitigate risk until a patch is available.

An attacker with organization notification administrator privileges can exploit this SSRF vulnerability to cause the AWX control node to send HTTP requests to internal or loopback network addresses, potentially accessing services that are not externally reachable. The webhook backend's behavior of following redirects and resending Basic Authentication credentials can lead to credential leakage if redirected to an attacker-controlled host. The Grafana backend's transmission of its API key in the Authorization header to the configured URL further risks credential exposure. This can lead to unauthorized access to internal services and exfiltration of sensitive credentials. The vulnerability does not impact confidentiality of data directly but can enable unauthorized internal network probing and credential theft.

There is currently no complete mitigation other than applying the update when it becomes available. Until a fix is released, Red Hat recommends the following measures: 1) Restrict the ability to create and modify notification templates to trusted administrators only. 2) Implement network egress filtering on Automation Controller nodes to block outbound connections to loopback (127.0.0.0/8), private (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), and link-local (169.254.0.0/16) IP ranges. 3) Monitor notification template configurations for URLs pointing to internal or unusual addresses. 4) Avoid configuring sensitive credentials such as Basic Authentication or Grafana API keys in notification templates until the fix is applied; prefer backends that do not require credentials. 5) Review and audit existing notification templates for URLs targeting internal services.