An attacker who possesses administrative rights on a job template configured for webhooks can access the template's webhook signing key. This access allows the attacker to forge a signed GitHub webhook payload containing a malicious 'statuses_url'. When AWX processes this forged payload, it sends an authenticated HTTP POST request to the attacker-defined URL. Because the request includes the configured Git Personal Access Token (PAT) within the Authorization header, this vulnerability enables the silent exfiltration of credentials to external or internal attacker-controlled endpoints.

Impact

The impact of this vulnerability is significant, as it facilitates the unauthorized exfiltration of Git Personal Access Tokens used for integration with version control systems. Organizations utilizing AWX for automated job templates are at risk of losing service account credentials, which could lead to further unauthorized access, code repository tampering, or lateral movement within the development pipeline.

Recommendation

• Audit all AWX job templates configured for webhooks to identify and restrict administrative access.
• Implement egress filtering at the network level to prevent AWX server instances from initiating connections to unauthorized or untrusted external domains.
• Review access logs and audit trails for job templates to identify potentially unauthorized webhook configuration changes.
• Monitor AWX server outbound traffic logs for unexpected POST requests directed toward non-Git provider infrastructure.
• Patch AWX to the latest version provided by Red Hat that addresses CVE-2026-71365.