UBUNTU-CVE-2026-126642: Medium severity ubuntu/ansible vulnerability
An incorrect authorization flaw was found in AWX, the automation controller component of Red Hat Ansible Automation Platform. The API access classes for JobTemplate and WorkflowJobTemplate do not check the caller's Credential userole when assigning the single-valued webhookcredential foreign key: JobTemplateAccess.canadd/canchange and WorkflowJobTemplateAccess.canchange in awx/main/access.py omit the checkrelated('webhookcredential', Credential, ..., rolefield='userole') call that UnifiedCredentialsMixin.canattach performs for the normal many-to-many credentials relationship, and the serializer validates only the credential's type and namespace. A user who may administer their own job template (or workflow job template) and use its project and inventory can therefore attach a webhook token credential (for example a GitLab token) that they do not have use permission on. The template administrator can retrieve the template's webhook key; a subsequent webhook event causes AWX to decrypt the attached token and send it in the request header (for GitLab, PRIVATE-TOKEN) to a status URL derived from the event payload, disclosing the victim's token to a destination the attacker can influence. This may disclose another user's personal access token and allow whatever actions that token permits.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A user who can administer a JobTemplate or WorkflowJobTemplate and use its associated project and inventory can exploit it. They must also be able to attach a webhook credential that belongs to another user but for which they lack use permission.
What access or interaction is required to disclose a credential token?
The attacker needs to retrieve the template's webhook key and cause a subsequent webhook event. AWX then decrypts the attached credential and sends its token in a request header to a status URL derived from the event payload.
What credentials are at risk?
Webhook token credentials are affected, including a GitLab token sent in the PRIVATE-TOKEN request header. The flaw concerns the single-valued webhook_credential field on job templates and workflow job templates.
How can administrators identify potentially affected templates?
Review JobTemplate and WorkflowJobTemplate configurations for webhook_credential assignments, especially where the template administrator does not have use permission on the assigned Credential. Also review whether those templates expose webhook keys and accept webhook events that can supply status URLs.