Threats Tagged 'cve-2026-71366'

CVE-2026-71366 is a server-side request forgery (SSRF) vulnerability in multiple notification backends of Red Hat Ansible Automation Platform 2.5 for RHEL 8. The affected backends include webhook, Mattermost, Rocket.Chat, and Grafana, which use notification template URLs as direct HTTP request targets without validating the target address against private, loopback, or reserved IP ranges. This allows an organization notification administrator to cause the AWX control node to issue HTTP requests to internal or loopback addresses. Additionally, the webhook backend follows HTTP redirects and resends Basic Authentication credentials to redirected hosts, potentially leaking credentials. The Grafana backend sends its API key in the Authorization header to the configured target URL. A fix is available from Red Hat.

CVE-2026-71366 is a server-side request forgery (SSRF) vulnerability affecting multiple notification backends in Red Hat Ansible Automation Platform 2.5 for RHEL 8. The affected backends (webhook, Mattermost, Rocket.Chat, and Grafana) do not validate notification template URLs against private, loopback, or reserved IP ranges, allowing an organization notification administrator to cause the AWX control node to send HTTP requests to internal or loopback addresses. The webhook backend also follows HTTP redirects and resends Basic Authentication credentials to redirected hosts without validation, risking credential exfiltration. The Grafana backend exposes its API key to the configured target URL. Red Hat has rated this vulnerability as having an Important impact and has released a security update to fix it.

Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams, while automation developers retain the freedom to write tasks that leverage existing knowledge without the overhead. Ansible Automation Platform makes it possible for users across an organization to share, vet, and manage automation content by means of a simple, powerful, and agentless language. Security Fix(es): * automation-controller: notification backends allow SSRF and credential leakage (CVE-2026-71366) * automation-controller: webhook status callback SSRF leaks the Git PAT (CVE-2026-71365) * automation-controller: project archive extraction allows path traversal file writes (CVE-2026-71364) * automation-controller: AIOHTTP: Denial of Service via malformed HTTP responses (CVE-2026-69244) * automation-controller: pyasn1: Denial of Service via crafted ASN.1 REAL values (CVE-2026-59886) * automation-controller: AIOHTTP: Arbitrary code execution via untrusted input to CookieJar.load() (CVE-2026-34993) * automation-controller: path traversal via YAML !include directive (CVE-2026-52902) * automation-controller: JWCrypto: Memory exhaustion via crafted compressed JWE tokens (CVE-2026-39373) * automation-gateway: path Traversal via unsanitized prefix/postfix enables directory escape (CVE-2026-44705) * python3.12-aiohttp: HTTP Request Smuggling via WebSocket Upgrade (CVE-2026-69243) * python3.12-aiohttp: Denial of Service via malformed HTTP responses (CVE-2026-69244) * python3.12-django: Remote code execution via GeoDjango spatial lookups (CVE-2026-15307) * python3.12-gitpython: Command Injection via Git option prefix abbreviation (CVE-2026-67325) * python3.12-gitpython: Arbitrary Code Execution via Joined Short Options Bypass (CVE-2026-67324) * python3.12-gitpython: Arbitrary code execution via command injection due to unguarded Git options (CVE-2026-67323) * python3.12-gitpython: Environment variable exfiltration via attacker-controlled clone URL (CVE-2026-67322) * python3.12-gitpython: Arbitrary file overwrite and read via unsafe git option forwarding (CVE-2026-73620) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details about this release, refer to the release notes listed in the References section.