Executive brief
A security flaw in the AWX and Ansible Automation Controller GitHub integration allows an attacker to steal sensitive GitHub access tokens. By sending a specially crafted notification (webhook) to the system, an attacker can trick the controller into sending its login credentials to a server they control. This could lead to unauthorized access to the organization's GitHub repositories and private code.
Technical details
A second-order Server-Side Request Forgery (SSRF) exists in the GitHub webhook receiver of AWX and Ansible Automation Controller. The application fails to validate the 'statuses_url' field within a GitHub pull_request webhook payload before storing it. When a job triggered by the webhook completes, the controller uses this unvalidated URL to post status updates. If the job template is configured with a GitHub Personal Access Token (PAT) for authentication, the controller includes this token in the Authorization header of the POST request. An attacker with knowledge of the job template's webhook shared secret (webhook_key) can submit a signed forged webhook to redirect the callback to an attacker-controlled endpoint, thereby capturing the PAT.
Affected products
- Red Hat Ansible Automation Platform 2 2.6, 2.7
- Ansible AWX
- Red Hat Automation Controller
Timeline
- 2026-06-19: disclosed: CVE published and reported by Red Hat