CVE-2026-84644: SSRF

Published Sep 1, 2026

Updated

A flaw was found in automation-controller (AWX). The external credential test endpoints execute the credential plugin backend in-process in the controller web service (awx/api/views/init.py CredentialExternalTest / CredentialTypeExternalTest -> callbackendwitherrorhandling -> plugin.backend()). CredentialExternalTest uses objpermissiontype='use' and merges request-body 'inputs' over the stored credential inputs, so a user with only the use role can override serverurl. The Thycotic Secret Server plugin (awx-plugins src/awxplugins/credentials/tss.py tssbackend) passes serverurl verbatim into the delinea/thycotic SDK, which issues GET {serverurl}/api/v1/ healthcheck and GET {serverurl}/health and, on a healthy response, POST {serverurl}/oauth2/token, with no allow-list, scheme, IP-range, or DNS-rebind check. Errors are wrapped as a bare SecretServerError (blind), but latency differs by target state (refused ~0.5s vs filtered ~12s until the gateway 503s), yielding a reliable timing oracle for scanning in-cluster services, the Kubernetes API, link-local metadata (169.254.169.254), and localhost daemons from the control-plane pod. This is the same root-cause class as the previously reported HashiCorp Vault / Centrify / CyberArk CCP credential-plugin SSRFs; Thycotic Secret Server is an additional sink. Discovered internally; verified live on AAP 2.6/2.7 / automation-controller 4.8.1; still present on devel (both awx and awx-plugins). Upstream: github.com/ansible/awx (awx/api/views/init.py CredentialExternalTest, CredentialTypeExternalTest, callbackendwitherrorhandling); github.com/ansible/awx-plugins (src/awxplugins/credentials/tss.py tssbackend)

Affected Software

1 affected component

Ansible AWX

Event History

Sep 1, 2026

Data Sourced

via Red Hat·09:49 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which users can trigger the outbound requests?

A user with only the use role on a stored external credential can invoke the credential test endpoint. The endpoint merges request-body inputs over the stored credential inputs, allowing that user to replace server_url.

When is this issue relevant in an AWX deployment?

The affected path involves external credential testing with the Thycotic Secret Server plugin backend. That backend passes the supplied server_url directly to the Delinea/Thycotic SDK without an allow-list, scheme restriction, IP-range validation, or DNS-rebinding check.

What can an attacker learn or reach through the vulnerable path?

The controller web service can be induced to request attacker-selected targets, including in-cluster services, the Kubernetes API, link-local metadata at 169.254.169.254, and localhost daemons from the control-plane pod. Although errors are blind, response timing distinguishes some target states, creating a reliable scanning oracle.

What requests does the backend make to a supplied target?

It sends GET requests to {server_url}/api/v1/healthcheck and {server_url}/health. If the target appears healthy, it also sends a POST request to {server_url}/oauth2/token.

CVE-2026-84644: SSRF

Affected Software

Event History

Frequently Asked Questions

Which users can trigger the outbound requests?

When is this issue relevant in an AWX deployment?

What can an attacker learn or reach through the vulnerable path?

What requests does the backend make to a supplied target?

Company

Resources

Contact

Frequently Asked Questions

Which users can trigger the outbound requests?

When is this issue relevant in an AWX deployment?

What can an attacker learn or reach through the vulnerable path?

What requests does the backend make to a supplied target?