Is CVE-2026-76648 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-76648 being exploited in the wild.

How severe is CVE-2026-76648?

High severity, with a CVSS score of 8.5, published 23 September 2026.

Is there a fix for CVE-2026-76648?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-76648 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-76648?

Check whether you run Red Hat Ansible Automation Platform. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-76648: Red Hat Ansible Automation Platform authorization bypass in CopyAPIView

CVE-2026-76648 · Severity: high · CVSS 8.5 · Published 2026-09-23

Red Hat Ansible Automation Platform's copy API endpoint fails to properly check whether a user has permission to read the source job template before allowing them to copy it. An authenticated user could exploit this to copy job templates they should not have access to, potentially gaining access to sensitive configuration, credentials, and automation workflows.

Technologies: Red Hat Ansible Automation Platform. Vendors: Red Hat.

Quick answers

Is CVE-2026-76648 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-76648 being exploited in the wild.
How severe is CVE-2026-76648?: High severity, with a CVSS score of 8.5, published 23 September 2026.
Which products and versions are affected?: Red Hat Ansible Automation Platform.
Is there a fix for CVE-2026-76648?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-76648 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-76648?: Check whether you run Red Hat Ansible Automation Platform. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The CopyAPIView's POST handler in awx/api/generics.py checks can_access() for 'add' and 'copy_related' permissions but does not verify the user can 'read' the source object before copying it. This bypasses object-level RBAC enforcement. The vulnerability requires authentication and affects JobTemplate and likely other copyable resources where the copy permission checks do not imply read access on the source object.

Affected products

Red Hat Ansible Automation Platform

Timeline

2026-09-23: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.