CVE-2026-71366 Awx: notification backends allow ssrf and credential leakage
AWX notification backends allow SSRF and credential leakage via unvalidated URLs and redirect handling, enabling access to internal services and credential theft.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-71366?
CVE-2026-71366 is a high-severity server-side request forgery vulnerability in Red Hat Ansible Automation Platform 2.5 for RHEL 8, published on 24 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A server-side request forgery (SSRF) vulnerability was found in multiple AWX notification backends. The webhook, Mattermost, Rocket.Chat, and Grafana notification backends use notification template URLs as direct HTTP request targets without validating the target address against private, loopback, or reserved IP ranges. An organization notification administrator can create notification templates pointing to internal or loopback addresses, causing the AWX control node to issue HTTP requests to services that are not externally accessible. Additionally, the webhook notification backend follows HTTP redirects and resends configured Basic Authentication credentials to redirect targets regardless of host change, allowing an attacker to exfiltrate notification credentials by redirecting to an attacker-controlled host. The Grafana backend sends its API key in the Authorization header to the configured target URL.
Weakness: CWE-918
Which versions are affected by CVE-2026-71366?
How do I fix CVE-2026-71366?
Apply the vendor's patch.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-71366 being exploited?
There is no known exploitation of CVE-2026-71366 in the wild and no public exploit code.
Sources
Also known as GHSA-8vqh-rjh4-52qh.