Executive brief
A server-side request forgery (SSRF) vulnerability exists in AWX notification backends (webhook, Mattermost, Rocket.Chat, and Grafana). An organization notification administrator can create notification templates pointing to internal services, causing the AWX control node to issue unauthorized HTTP requests to non-publicly accessible systems. Additionally, some backends follow HTTP redirects and expose authentication credentials to attacker-controlled hosts, enabling credential theft.
Technical details
The vulnerability is a server-side request forgery (SSRF) affecting multiple notification backends in AWX. The root cause is insufficient validation of notification template URLs before using them as HTTP request targets; the backends do not validate against private, loopback, or reserved IP ranges. The webhook backend additionally follows HTTP redirects and resends Basic Authentication credentials to redirect targets regardless of hostname change, and the Grafana backend sends its API key in the Authorization header. An authenticated notification administrator can exploit this with network access to create a malicious notification template. Patches are expected from Red Hat.
Affected products
- Red Hat AWX <UNKNOWN>
Timeline
- 2026-08-24: disclosed
- advisory: CVE-2026-71366