CVE-2026-71363
Description
A flaw was found in AWX. The debug API endpoints (/api/debug/task_manager/, /api/debug/dependency_manager/, /api/debug/workflow_manager/) are registered unconditionally in the URL configuration and use AllowAny permission class with _ignore_model_permissions=True. This allows an unauthenticated remote attacker to repeatedly invoke scheduler operations that acquire database advisory locks and open transactions, potentially leading to resource exhaustion and degraded service availability.
Statement
Red Hat has assessed this vulnerability as Moderate impact. The debug endpoints allow unauthenticated callers to trigger scheduler operations that would otherwise run on a periodic timer. While the lack of authentication is a security defect, the practical impact is limited to service degradation through lock contention under sustained attack. The scheduler's advisory locking mechanism serializes concurrent invocations, preventing true parallel execution and limiting the resource consumption per request. In Red Hat Ansible Automation Platform 2.5 and later, the Platform Gateway provides an additional authentication layer in front of the Automation Controller API, which may prevent unauthenticated access to these endpoints depending on deployment configuration. Customers are advised to restrict network access to the Automation Controller API to trusted networks.
Mitigation
There is no complete mitigation for this vulnerability other than applying the update when available. However, the following measures reduce exposure:
1. Restrict network access to the Automation Controller API (/api/) to trusted networks and authenticated clients using firewall rules or reverse proxy configuration.
2. Configure a reverse proxy or web application firewall to block requests to /api/debug/* paths.
3. In AAP 2.5+ deployments, ensure that the Automation Controller API is not directly accessible bypassing the Platform Gateway.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.3 | N/A | N/A |
| Attack Vector | Network | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | None | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | Low | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Understanding the Weakness (CWE)
Access Control,Other
Technical Impact: Gain Privileges or Assume Identity; Varies by Context
Exposing critical functionality essentially provides an attacker with the privilege level of that functionality. The consequences will depend on the associated functionality, but they can range from reading or modifying sensitive data, accessing administrative or other privileged functionality, or possibly even executing arbitrary code.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
