CVE-2026-71367— Awx: websocket broadcast groups leak cross-organization job metadata

Quick assessment

Affected

Red Hat Red Hat Ansible Automation Platform 2

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 AWX 的 WebSocket 消费者中发现了一个授权错误漏洞。该组件中的函数仅对对象级事件组（如、、）实施访问控制，却未限制对全局广播组（例如）的订阅。当已认证用户尝试订阅全局广播组时，服务器会直接接受该订阅，而不会验证该用户是否具备查看相关资源的权限。在多组织部署环境中，这使得某个组织中的低权限用户能够接收来自所有组织的实时作业状态元数据，包括作业 ID、状态变更、时间戳以及基础设施拓扑详情（如实例组名称），从而绕过了 REST API 所强制实施的组织隔离机制。

CVSS 4.3 · Medium Updated Nov 12, 2026

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Awx: websocket broadcast groups leak cross-organization job metadata

Source: CVE Program / CVE List V5

Vulnerability Description

An incorrect authorization vulnerability was found in AWX's WebSocket consumer. The consumer_access() function only enforces access controls for object-level event groups (job_events, workflow_events, ad_hoc_command_events) but does not restrict subscriptions to global broadcast groups such as 'jobs-status_changed'. When an authenticated user subscribes to a global broadcast group, the server accepts the subscription without verifying that the user has permission to view the associated resources. In multi-organization deployments, this allows a low-privilege user in one organization to receive real-time job status metadata from all organizations, including job IDs, status transitions, timestamps, and infrastructure topology details such as instance group names, bypassing the organization isolation enforced by the REST API.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

授权机制不正确

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE
Red Hat	Red Hat Ansible Automation Platform 2	-	`cpe:/a:redhat:ansible_automation_platform:2`
Red Hat	Red Hat Ansible Automation Platform 2	-	`cpe:/a:redhat:ansible_automation_platform:2`
Red Hat	Red Hat Ansible Automation Platform 2	-	`cpe:/a:redhat:ansible_automation_platform:2`

II. Public POCs for CVE-2026-71367

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-71367

请登录查看更多情报信息。

Other References for CVE-2026-71367 (2)

https://access.redhat.com/security/cve/CVE-2026-71367 vdb-entry x_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2511903 issue-tracking x_refsource_REDHAT

https://www.cve.org/CVERecord?id=CVE-2026-71367

Same Patch Batch · Red Hat · 2026-11-12 · 5 CVEs total

CVE-2026-126643	6.5 MEDIUM	Aap-gateway-operator: resource-server secret exposed in plaintext in the automationcontrol
CVE-2026-126641	6.5 MEDIUM	Ansible-pylibssh: accepts a changed ssh host key when host_key_auto_add is enabled
CVE-2026-126642	6.5 MEDIUM	Awx: webhook credential assignment omits use_role check, exposing another user's token
CVE-2026-126644	3.9 LOW	Ansible.posix: authorized_key module follows a parent-directory symlink allowing writes ou

IV. Related Vulnerabilities

Same product: Red Hat Ansible Automation Platform 2

Same vendor: Red Hat

Same weakness: CWE-863