# CVE-2026-71367: AWX WebSocket consumer incorrect authorization

Source: https://junglewise.ai/threats/cve-2026-71367-an-incorrect-authorization-vulnerability-was-found-in-awx-s  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-12. Updated: 2026-11-12  
License: CC BY 4.0 with a link back

CVE-2026-71367 · Severity: medium · CVSS 4.3 · Published 2026-11-12

AWX is a configuration management platform that automates infrastructure and job execution. An authentication bypass in its WebSocket service allows low-privilege users to receive real-time job status and infrastructure metadata from other organizations in multi-organization deployments, leaking job IDs, timing, and system topology information that should be restricted.

Technologies: [Red Hat Ansible Automation Platform](https://junglewise.ai/threats/technologies/ansible-automation-platform-2). Vendors: [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-71367 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-71367 being exploited in the wild.

**How severe is CVE-2026-71367?** Medium severity, with a CVSS score of 4.3, published 12 November 2026.

**Which products and versions are affected?** Red Hat Ansible Automation Platform.

**Is there a fix for CVE-2026-71367?** No fixed version is recorded yet. Restrict WebSocket upgrade requests (/websocket/) to authenticated sessions with known legitimate use cases via a reverse proxy or load balancer; in multi-organization deployments, restrict user account creation and audit organization memberships; monitor WebSocket subscription activity for cross-organization access patterns.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-11-12"}] If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-71367 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-71367?** Check whether you run Red Hat Ansible Automation Platform. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Restrict WebSocket upgrade requests (/websocket/) to authenticated sessions with known legitimate use cases via a reverse proxy or load balancer; in multi-organization deployments, restrict user account creation and audit organization memberships; monitor WebSocket subscription activity for cross-organization access patterns.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-11-12"}]

## Technical details

The consumer_access() function in AWX's WebSocket consumer fails to enforce organization-level access controls on global broadcast groups (e.g., 'jobs-status_changed'), only restricting object-level groups (job_events, workflow_events, ad_hoc_command_events). An authenticated user can subscribe to broadcast groups without permission verification, gaining visibility into job metadata across organizations in multi-org deployments. This is a confidentiality issue in network-accessible WebSocket functionality requiring only low-privilege authentication.

## Affected products

- Red Hat Ansible Automation Platform

## References

- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/security/cve/CVE-2026-71367](https://access.redhat.com/security/cve/CVE-2026-71367)

## Related threats

- [Red Hat Ansible Automation Platform cleartext storage of resource-server secret](https://junglewise.ai/threats/cve-2026-126643-a-cleartext-storage-flaw-was-found-in-the-aap-gateway-operator)
- [Pulpcore expression language injection in content guard](https://junglewise.ai/threats/cve-2026-123084-an-expression-language-injection-has-been-found-in-the)
- [Red Hat Ansible Automation Platform stored XSS in Hub documentation renderer](https://junglewise.ai/threats/cve-2026-109131-the-hub-collection-module-documentation-renderer-in-the-unified)
- [Ansible Operator Jinja2 template injection](https://junglewise.ai/threats/cve-2026-92982-a-flaw-was-found-in-ansible-operator-plugins-a-low-privileged)
- [Red Hat Ansible Automation Platform duplicate CVE](https://junglewise.ai/threats/cve-2026-104710-rejected-reason-duplicate-of-which-was-publicly-disclosed-and)