REDHAT-BUG-2527117: SSRF

Published Sep 1, 2026

Updated

A flaw was found in automation-controller (AWX). The external credential test endpoints execute the credential plugin backend in-process in the controller web service (awx/api/views/init.py CredentialExternalTest / CredentialTypeExternalTest -> callbackendwitherrorhandling -> plugin.backend()). CredentialExternalTest uses objpermissiontype='use' and merges request-body 'inputs' over the stored credential inputs, so a user with only the use role can override serverurl. The Thycotic Secret Server plugin (awx-plugins src/awxplugins/credentials/tss.py tssbackend) passes serverurl verbatim into the delinea/thycotic SDK, which issues GET {serverurl}/api/v1/ healthcheck and GET {serverurl}/health and, on a healthy response, POST {serverurl}/oauth2/token, with no allow-list, scheme, IP-range, or DNS-rebind check. Errors are wrapped as a bare SecretServerError (blind), but latency differs by target state (refused ~0.5s vs filtered ~12s until the gateway 503s), yielding a reliable timing oracle for scanning in-cluster services, the Kubernetes API, link-local metadata (169.254.169.254), and localhost daemons from the control-plane pod. This is the same root-cause class as the previously reported HashiCorp Vault / Centrify / CyberArk CCP credential-plugin SSRFs; Thycotic Secret Server is an additional sink. Discovered internally; verified live on AAP 2.6/2.7 / automation-controller 4.8.1; still present on devel (both awx and awx-plugins). Upstream: github.com/ansible/awx (awx/api/views/init.py CredentialExternalTest, CredentialTypeExternalTest, callbackendwitherrorhandling); github.com/ansible/awx-plugins (src/awxplugins/credentials/tss.py tssbackend)

Affected Software

1 affected component

Ansible automation-controller (AWX)=4.8.1

Event History

Sep 1, 2026

Data Sourced

via Red Hat·09:49 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who can trigger requests to attacker-chosen network targets?

A user with the use role on a stored credential can invoke the external credential test endpoint and override the credential's server_url through the request body. The issue specifically involves credentials using the Thycotic Secret Server plugin.

What network access does an attacker need to exploit this?

The attacker needs authenticated access sufficient to use the affected credential; they do not need direct network access to the target service. Requests originate from the controller web service/control-plane pod, allowing it to reach services accessible from that environment.

What targets could be probed from the controller?

The backend can be directed to in-cluster services, the Kubernetes API, link-local metadata at 169.254.169.254, and localhost daemons reachable from the control-plane pod. Response timing can distinguish refused targets from filtered ones, creating a scanning oracle.

How can teams identify potentially affected access paths?

Review use-role assignments for credentials configured with the Thycotic Secret Server plugin and identify users able to call external credential test functionality. Also review whether those users can supply or override credential inputs, including server_url, during tests.

REDHAT-BUG-2527117: SSRF

Affected Software

Event History

Frequently Asked Questions

Who can trigger requests to attacker-chosen network targets?

What network access does an attacker need to exploit this?

What targets could be probed from the controller?

How can teams identify potentially affected access paths?

Company

Resources

Contact

Frequently Asked Questions

Who can trigger requests to attacker-chosen network targets?

What network access does an attacker need to exploit this?

What targets could be probed from the controller?

How can teams identify potentially affected access paths?