Vulnerability · Published Jun 19, 2026 · Assigned by redhat

CVE-2026-12726Awx: automation-controller: awx: github webhook second-order ssrf via unvalidated statuses_url exfiltrates pat credential

Medium 6.3

In plain English

A medium-severity server-side request forgery in Red Hat Ansible Automation Platform 2 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)0.3%top 74.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A flaw was found in the AWX GitHub webhook integration. When processing GitHub pull_request webhooks, the controller stores the pull_request.statuses_url value from the webhook payload without validating that it points to a trusted GitHub API endpoint. If a job template is configured with a GitHub Personal Access Token as its webhook credential, the controller later POSTs that token to the stored callback URL when posting job status updates. An attacker who can submit a correctly signed forged webhook using the job template's webhook_key can redirect the callback to an attacker-controlled URL and exfiltrate the configured GitHub PAT.

Affected products (as reported)

Vendor	Product	Versions
Red Hat	Red Hat Ansible Automation Platform 2	see references
Red Hat	Red Hat Ansible Automation Platform 2	see references
Red Hat	Red Hat Ansible Automation Platform 2	see references

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

References

https://access.redhat.com/security/cve/CVE-2026-12726 vdb-entry, x_refsource_REDHAT
RHBZ#2490796 issue-tracking, x_refsource_REDHAT