Is CVE-2026-12726 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-12726 being exploited in the wild.

How severe is CVE-2026-12726?

Medium severity, with a CVSS score of 6.3, published 19 June 2026.

Which products and versions are affected?

Red Hat Ansible Automation Platform 2 2.6, 2.7; Ansible AWX; Red Hat Automation Controller.

Is there a fix for CVE-2026-12726?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-12726 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-12726?

Check whether you run Ansible AWX or Red Hat Automation Controller. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-12726: Red Hat Ansible Automation Controller SSRF in GitHub Webhook Integration

CVE-2026-12726 · Severity: medium · CVSS 6.3 · Published 2026-06-19

A security flaw in the AWX and Ansible Automation Controller GitHub integration allows an attacker to steal sensitive GitHub access tokens. By sending a specially crafted notification (webhook) to the system, an attacker can trick the controller into sending its login credentials to a server they control. This could lead to unauthorized access to the organization's GitHub repositories and private code.

Vendors: Ansible, Red Hat.

Quick answers

Is CVE-2026-12726 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-12726 being exploited in the wild.
How severe is CVE-2026-12726?: Medium severity, with a CVSS score of 6.3, published 19 June 2026.
Which products and versions are affected?: Red Hat Ansible Automation Platform 2 2.6, 2.7; Ansible AWX; Red Hat Automation Controller.
Is there a fix for CVE-2026-12726?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-12726 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-12726?: Check whether you run Ansible AWX or Red Hat Automation Controller. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A second-order Server-Side Request Forgery (SSRF) exists in the GitHub webhook receiver of AWX and Ansible Automation Controller. The application fails to validate the 'statuses_url' field within a GitHub pull_request webhook payload before storing it. When a job triggered by the webhook completes, the controller uses this unvalidated URL to post status updates. If the job template is configured with a GitHub Personal Access Token (PAT) for authentication, the controller includes this token in the Authorization header of the POST request. An attacker with knowledge of the job template's webhook shared secret (webhook_key) can submit a signed forged webhook to redirect the callback to an attacker-controlled endpoint, thereby capturing the PAT.

Affected products

Red Hat Ansible Automation Platform 2 2.6, 2.7
Ansible AWX
Red Hat Automation Controller

Timeline

2026-06-19: disclosed: CVE published and reported by Red Hat

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.