Search: CVE-2026-71365

CVE-2026-71365 is a server-side request forgery (SSRF) vulnerability in the webhook status callback mechanism of AWX, part of Red Hat Ansible Automation Platform 2.5 for RHEL 8. It allows a user with admin role on a webhook-enabled job template to forge GitHub webhook payloads with arbitrary status callback URLs, causing the system to send authenticated status updates including a Git Personal Access Token (PAT) to attacker-controlled or internal URLs. This leads to credential leakage and potential unauthorized internal network access. No complete fix is currently available, and mitigation involves restricting admin access, limiting credential scope, network egress filtering, monitoring, and credential rotation.