{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/awx/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.7,"id":"CVE-2026-71365"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["AWX"],"_cs_severities":["high"],"_cs_tags":["webserver","ssrf","credential-theft","vulnerability"],"_cs_type":"advisory","_cs_vendors":["Red Hat"],"content_html":"\u003cp\u003eCVE-2026-71365 is a critical server-side request forgery (SSRF) vulnerability identified in the AWX automation platform. The flaw exists within the webhook status callback mechanism, specifically when processing incoming GitHub pull request webhooks. AWX extracts the status callback URL from the payload without performing validation against expected Git provider domains.\u003c/p\u003e\n\u003cp\u003eAn attacker who possesses administrative rights on a job template configured for webhooks can access the template's webhook signing key. This access allows the attacker to forge a signed GitHub webhook payload containing a malicious 'statuses_url'. When AWX processes this forged payload, it sends an authenticated HTTP POST request to the attacker-defined URL. Because the request includes the configured Git Personal Access Token (PAT) within the Authorization header, this vulnerability enables the silent exfiltration of credentials to external or internal attacker-controlled endpoints.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe impact of this vulnerability is significant, as it facilitates the unauthorized exfiltration of Git Personal Access Tokens used for integration with version control systems. Organizations utilizing AWX for automated job templates are at risk of losing service account credentials, which could lead to further unauthorized access, code repository tampering, or lateral movement within the development pipeline.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAudit all AWX job templates configured for webhooks to identify and restrict administrative access.\u003c/li\u003e\n\u003cli\u003eImplement egress filtering at the network level to prevent AWX server instances from initiating connections to unauthorized or untrusted external domains.\u003c/li\u003e\n\u003cli\u003eReview access logs and audit trails for job templates to identify potentially unauthorized webhook configuration changes.\u003c/li\u003e\n\u003cli\u003eMonitor AWX server outbound traffic logs for unexpected POST requests directed toward non-Git provider infrastructure.\u003c/li\u003e\n\u003cli\u003ePatch AWX to the latest version provided by Red Hat that addresses CVE-2026-71365.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-18T16:55:49Z","date_published":"2026-08-18T16:55:49Z","id":"https://feed.craftedsignal.io/briefs/2026-08-awx-ssrf/","summary":"An SSRF vulnerability in the AWX webhook status callback mechanism allows attackers with template-level administrative access to exfiltrate Git Personal Access Tokens via forged webhook payloads.","title":"SSRF Vulnerability in AWX Webhook Callback Mechanism (CVE-2026-71365)","url":"https://feed.craftedsignal.io/briefs/2026-08-awx-ssrf/"}],"language":"en","title":"CraftedSignal Threat Feed - AWX","version":"https://jsonfeed.org/version/1.1"}