CVE-2026-71367
Description
An incorrect authorization vulnerability was found in AWX's WebSocket consumer. The consumer_access() function only enforces access controls for object-level event groups (job_events, workflow_events, ad_hoc_command_events) but does not restrict subscriptions to global broadcast groups such as 'jobs-status_changed'. When an authenticated user subscribes to a global broadcast group, the server accepts the subscription without verifying that the user has permission to view the associated resources. In multi-organization deployments, this allows a low-privilege user in one organization to receive real-time job status metadata from all organizations, including job IDs, status transitions, timestamps, and infrastructure topology details such as instance group names, bypassing the organization isolation enforced by the REST API.
Statement
Red Hat has assessed this vulnerability as Moderate impact for on-premise deployments. The WebSocket broadcast groups in AWX do not apply organization-level access controls, allowing any authenticated user to subscribe to global job status events and observe job metadata from other organizations. The leaked information is limited to job metadata (IDs, status, timing, instance group names) and does not include full job output, playbook content, or credentials. In single-organization deployments, which represent the majority of on-premise AAP installations, this vulnerability has no practical impact because all users already have visibility into the same job activity. In multi-organization on-premise deployments, the information disclosure is limited in scope and severity. For managed service deployments, the impact is higher because it constitutes a cross-tenant information disclosure that reveals job activity patterns, timing, and infrastructure topology between isolated tenants. Red Hat Ansible Automation Platform ships the affected code as part of Automation Controller.
Mitigation
There is no complete mitigation for this vulnerability other than applying the update when available. However, the following measures reduce exposure:
1. In multi-organization deployments, restrict user account creation to necessary personnel and audit user organization memberships.
2. If a reverse proxy or load balancer is in front of the Controller, consider restricting WebSocket upgrade requests (/websocket/) to authenticated sessions with known legitimate use cases.
3. For managed service deployments, engage the managed services team to assess whether additional network-level WebSocket filtering can be applied at the service mesh layer.
4. Monitor WebSocket subscription activity for users subscribing to broadcast groups outside their organization scope.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 4.3 | N/A | N/A |
| Attack Vector | Network | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | Low | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | None | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Application Data; Read Files or Directories
An attacker could bypass intended access restrictions to read sensitive data, either by reading the data directly from a data store that is not correctly restricted, or by accessing insufficiently-protected, privileged functionality to read the data.
Integrity
Technical Impact: Modify Application Data; Modify Files or Directories
An attacker could bypass intended access restrictions to modify sensitive data, either by writing the data directly to a data store that is not correctly restricted, or by accessing insufficiently-protected, privileged functionality to write the data.
Access Control
Technical Impact: Gain Privileges or Assume Identity; Bypass Protection Mechanism
An attacker could bypass intended access restrictions to gain privileges by modifying or reading critical data directly, or by accessing privileged functionality.
Confidentiality,Integrity,Availability
Technical Impact: Execute Unauthorized Code or Commands
An attacker could use elevated privileges to execute unauthorized commands or code.
Availability
Technical Impact: DoS: Crash, Exit, or Restart; DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Resource Consumption (Other)
An attacker could gain unauthorized access to resources on the system and excessively consume those resources, leading to a denial of service.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
