Is CVE-2026-126642 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-126642 being exploited in the wild.

How severe is CVE-2026-126642?

Medium severity, with a CVSS score of 6.5, published 12 November 2026.

How is CVE-2026-126642 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-126642?

Check whether you run Red Hat Ansible Automation Platform AWX. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-126642: Red Hat Ansible Automation Platform AWX authorization bypass in webhook credentials

CVE-2026-126642 · Severity: medium · CVSS 6.5 · Published 2026-11-12

AWX is the automation controller component of Red Hat Ansible Automation Platform, used to manage and execute automation workflows. An authorization flaw allows a template administrator to attach webhook credentials (such as GitLab tokens) that belong to other users without proper permission checks. When a webhook is triggered, AWX decrypts and sends the victim's token in request headers to an attacker-controlled destination, disclosing sensitive credentials that could be used to access external systems or perform actions on behalf of the victim.

Vendors: Red Hat.

Quick answers

Is CVE-2026-126642 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-126642 being exploited in the wild.
How severe is CVE-2026-126642?: Medium severity, with a CVSS score of 6.5, published 12 November 2026.
Which products and versions are affected?: Red Hat Ansible Automation Platform AWX.
Is there a fix for CVE-2026-126642?: No fixed version is recorded yet. Grant the Job Template and Workflow Job Template administrator role only to trusted users, and avoid storing webhook token credentials in organizations where untrusted users hold template-admin rights. There is no complete configuration-only mitigation; apply the fix when it becomes available. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-126642 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-126642?: Check whether you run Red Hat Ansible Automation Platform AWX. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Grant the Job Template and Workflow Job Template administrator role only to trusted users, and avoid storing webhook token credentials in organizations where untrusted users hold template-admin rights. There is no complete configuration-only mitigation; apply the fix when it becomes available.

Technical details

The vulnerability is a missing authorization check (CWE-862) in the JobTemplate and WorkflowJobTemplate API access classes in awx/main/access.py. These classes fail to validate the caller's credential use_role when assigning webhook_credential foreign keys, whereas the normal credentials relationship performs this check. An authenticated attacker with template-admin rights can enumerate and attach webhook credentials they don't have permission to use; subsequent webhook events trigger credential decryption and transmission to attacker-influenced URLs, leaking the token.

Affected products

Red Hat Ansible Automation Platform AWX

Timeline

2026-11-12: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.