CVE-2026-71365: Awx: webhook status callback ssrf leaks the git pat
A server-side request forgery (SSRF) vulnerability was found in AWX's webhook status callback mechanism. When processing GitHub pull request webhooks, AWX extracts the status callback URL (pullrequest.statusesurl) from the incoming webhook payload without validating the target host against the expected Git provider. This URL is persisted in job extra variables and later used to send authenticated status updates. A user with admin role on a webhook-enabled job template can read the template's webhook signing key, forge a signed GitHub webhook payload with an arbitrary statusesurl, and cause AWX to POST status updates to an attacker-controlled or internal URL. The status update request includes the configured Git Personal Access Token (PAT) in the Authorization header, resulting in credential leakage to the attacker-specified endpoint.
Affected Software
Event History
Frequently Asked Questions
Which AWX deployments are realistically exposed?
Exposure is limited to webhook-enabled job templates that process GitHub pull request webhooks and have a Git Personal Access Token configured for status updates. An attacker also needs an admin role on the affected job template so they can read its webhook signing key.
What does an attacker need to do to exploit this?
The attacker must forge a GitHub webhook payload that passes signature validation and set pull_request.statuses_url to an attacker-controlled or internal address. AWX later sends an authenticated status update to that address, including the configured Git PAT in the Authorization header.
What mitigations are available before a fix is applied?
If patching cannot happen immediately, restrict admin access to webhook-enabled job templates, especially access that permits reading webhook signing keys. Disable affected webhook processing or remove the configured Git PAT from status-update use where operationally feasible.
How can administrators identify potentially affected configurations or exploitation?
Review webhook-enabled GitHub pull-request job templates for users with admin access and for configured Git PATs used in status callbacks. Investigate status-update requests for unexpected callback hosts, particularly internal addresses or domains outside the expected Git provider.