CVE-2026-71366

{"id": "CVE-2026-71366", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-71366", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-26T18:26:07.022897Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 3.1}]}, "affected": [{"source": "secalert@redhat.com", "affectedData": [{"cpes": ["cpe:/a:redhat:ansible_automation_platform:2.5::el8", "cpe:/a:redhat:ansible_automation_platform:2.5::el9", "cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8", "cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9"], "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2.5 for RHEL 8", "versions": [{"status": "unaffected", "version": "0:4.6.32-1.el8ap", "lessThan": "*", "versionType": "rpm"}], "packageName": "automation-controller", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:ansible_automation_platform:2.5::el8", "cpe:/a:redhat:ansible_automation_platform:2.5::el9", "cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8", "cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9"], "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2.5 for RHEL 9", "versions": [{"status": "unaffected", "version": "0:4.6.32-1.el9ap", "lessThan": "*", "versionType": "rpm"}], "packageName": "automation-controller", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:ansible_automation_platform:2.6::el10", "cpe:/a:redhat:ansible_automation_platform:2.6::el9", "cpe:/a:redhat:ansible_automation_platform_developer:2.6::el10", "cpe:/a:redhat:ansible_automation_platform_developer:2.6::el9", "cpe:/a:redhat:ansible_automation_platform_inside:2.6::el9"], "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2.6 for RHEL 9", "versions": [{"status": "unaffected", "version": "0:4.7.16-1.el9ap", "lessThan": "*", "versionType": "rpm"}], "packageName": "automation-controller", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:ansible_automation_platform:2.6::el9"], "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2.6", "versions": [{"status": "unaffected", "version": "1787244009", "lessThan": "*", "versionType": "rpm"}], "packageName": "ansible-automation-platform-26/controller-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:ansible_automation_platform:2.7::el9"], "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2.7", "versions": [{"status": "unaffected", "version": "1787220257", "lessThan": "*", "versionType": "rpm"}], "packageName": "ansible-automation-platform-27/controller-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}]}], "published": "2026-08-24T16:17:22.820", "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:59135", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:59136", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:59153", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:59155", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/security/cve/CVE-2026-71366", "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511902", "source": "secalert@redhat.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "A server-side request forgery (SSRF) vulnerability was found in multiple AWX notification backends. The webhook, Mattermost, Rocket.Chat, and Grafana notification backends use notification template URLs as direct HTTP request targets without validating the target address against private, loopback, or reserved IP ranges. An organization notification administrator can create notification templates pointing to internal or loopback addresses, causing the AWX control node to issue HTTP requests to services that are not externally accessible. Additionally, the webhook notification backend follows HTTP redirects and resends configured Basic Authentication credentials to redirect targets regardless of host change, allowing an attacker to exfiltrate notification credentials by redirecting to an attacker-controlled host. The Grafana backend sends its API key in the Authorization header to the configured target URL."}, {"lang": "es", "value": "Se encontr\u00f3 una vulnerabilidad de falsificaci\u00f3n de petici\u00f3n del lado del servidor (SSRF) en m\u00faltiples backends de notificaci\u00f3n de AWX. Los backends de notificaci\u00f3n de webhook, Mattermost, Rocket.Chat y Grafana utilizan URL de plantillas de notificaci\u00f3n como objetivos directos de petici\u00f3n HTTP sin validar la direcci\u00f3n objetivo contra rangos de IP privados, de bucle invertido o reservados. Un administrador de notificaciones de la organizaci\u00f3n puede crear plantillas de notificaci\u00f3n que apunten a direcciones internas o de bucle invertido, haciendo que el nodo de control de AWX emita peticiones HTTP a servicios que no son accesibles externamente. Adem\u00e1s, el backend de notificaci\u00f3n de webhook sigue redirecciones HTTP y reenv\u00eda credenciales de autenticaci\u00f3n b\u00e1sica configuradas a objetivos de redirecci\u00f3n independientemente del cambio de host, permitiendo a un atacante exfiltrar credenciales de notificaci\u00f3n redirigiendo a un host controlado por el atacante. El backend de Grafana env\u00eda su clave API en la cabecera de autorizaci\u00f3n a la URL objetivo configurada."}], "lastModified": "2026-10-14T13:10:00.187", "sourceIdentifier": "secalert@redhat.com"}