CVE-2026-16544

A flaw was found in AWX. The websocket event consumer performs RBAC authorization checks only for event groups that are mapped in the consumer_access() function (job_events, workflow_events, ad_hoc_command_events). Three event groups - inventory_update_events, project_update_events, and system_job_events — are not mapped, causing the authorization check to be skipped. Any authenticated user can subscribe to these unmapped websocket event groups for any object ID and receive real-time stdout output from jobs belonging to organizations they have no access to. This is an incomplete remediation of CVE-2020-10698.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://access.redhat.com/security/cve/CVE-2026-16544
https://bugzilla.redhat.com/show_bug.cgi?id=2506053

Configurations

No configuration.

History

24 Oct 2026, 17:10

Type	Values Removed	Values Added
Summary		(es) Se encontró una falla en AWX. El consumidor de eventos de websocket realiza comprobaciones de autorización RBAC solo para grupos de eventos que están mapeados en la función consumer_access() (job_events, workflow_events, ad_hoc_command_events). Tres grupos de eventos - inventory_update_events, project_update_events y system_job_events - no están mapeados, lo que provoca que se omita la comprobación de autorización. Cualquier usuario autenticado puede suscribirse a estos grupos de eventos de websocket no mapeados para cualquier ID de objeto y recibir la salida stdout en tiempo real de trabajos que pertenecen a organizaciones a las que no tienen acceso. Esta es una remediación incompleta de CVE-2020-10698.

Information

Published : 2026-07-22 12:17

Updated : 2026-10-24 17:10

NVD link : CVE-2026-16544

Mitre link : CVE-2026-16544

CVE.ORG link : CVE-2026-16544

JSON object : View

Products Affected

No product.

CWE

CWE-862

Missing Authorization

{"id": "CVE-2026-16544", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-16544", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-22T17:47:34.263602Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "secalert@redhat.com", "affectedData": [{"cpes": ["cpe:/a:redhat:ansible_automation_platform:2"], "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "packageName": "ansible-automation-platform-27/controller-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:ansible_automation_platform:2"], "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "packageName": "automation-controller", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}]}], "published": "2026-07-22T12:17:10.480", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-16544", "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2506053", "source": "secalert@redhat.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "A flaw was found in AWX. The websocket event consumer performs RBAC authorization checks only for event groups that are mapped in the consumer_access() function (job_events, workflow_events, ad_hoc_command_events). Three event groups - inventory_update_events, project_update_events, and system_job_events \u2014 are not mapped, causing the authorization check to be skipped. Any authenticated user can subscribe to these unmapped websocket event groups for any object ID and receive real-time stdout output from jobs belonging to organizations they have no access to. This is an incomplete remediation of CVE-2020-10698."}, {"lang": "es", "value": "Se encontr\u00f3 una falla en AWX. El consumidor de eventos de websocket realiza comprobaciones de autorizaci\u00f3n RBAC solo para grupos de eventos que est\u00e1n mapeados en la funci\u00f3n consumer_access() (job_events, workflow_events, ad_hoc_command_events). Tres grupos de eventos - inventory_update_events, project_update_events y system_job_events - no est\u00e1n mapeados, lo que provoca que se omita la comprobaci\u00f3n de autorizaci\u00f3n. Cualquier usuario autenticado puede suscribirse a estos grupos de eventos de websocket no mapeados para cualquier ID de objeto y recibir la salida stdout en tiempo real de trabajos que pertenecen a organizaciones a las que no tienen acceso. Esta es una remediaci\u00f3n incompleta de CVE-2020-10698."}], "lastModified": "2026-10-24T17:10:00.220", "sourceIdentifier": "secalert@redhat.com"}