Description
A flaw was found in AWX. The websocket event consumer performs RBAC authorization checks only for event groups that are mapped in the consumer_access() function (job_events, workflow_events, ad_hoc_command_events). Three event groups - inventory_update_events, project_update_events, and system_job_events — are not mapped, causing the authorization check to be skipped. Any authenticated user can subscribe to these unmapped websocket event groups for any object ID and receive real-time stdout output from jobs belonging to organizations they have no access to. This is an incomplete remediation of CVE-2020-10698.
Published: 2026-07-22
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The event consumer in AWX performs RBAC checks only for certain event groups. Three event groups—inventory_update_events, project_update_events, and system_job_events—are not checked. As a result, any authenticated user may subscribe to these streams for any object ID and receive real‑time stdout from jobs in organizations the user should not access. This allows cross‑organization disclosure of potentially sensitive output. The flaw is a missing authorization check (CWE‑862).

Affected Systems

The vulnerability is present in Red Hat Ansible Automation Platform 2. Users running the AWX/Controller component of this platform are vulnerable. No other product versions are listed.

Risk and Exploitability

Based on the CVSS score of 6.5 the risk is classified as medium. The EPSS score of < 1% indicates a very low but non‑zero exploitation probability, and the vulnerability is not listed in CISA KEV. Attackers only need to be authenticated; the flaw does not require privileged roles. Any logged‑in user could subscribe via the websocket interface and obtain confidential stdout data, with no special environmental conditions beyond normal authentication and websocket access.

Generated by OpenCVE AI on August 4, 2026 at 00:03 UTC.

Remediation

Vendor Workaround

The following practices would help for avoiding exposure and mitigate this flaw: - Restrict AWX/Controller user account creation to only trusted individuals. Since any authenticated user can exploit this flaw regardless of role, minimizing the number of user accounts reduces the attack surface. - Use external authentication (LDAP, SAML, OIDC) with strict group mappings to prevent self-registration and ensure only authorized users can log in. - Review the list of AWX/Controller users and remove or deactivate any accounts that are no longer needed. - Monitor websocket connections and subscriptions for unusual patterns, such as a user subscribing to inventory_update_events or project_update_events for object IDs outside their organization. - Avoid embedding credentials in SCM URLs or inventory source configurations, as these may appear in stdout output. Use credential objects instead. - Apply network segmentation to restrict access to the AWX/Controller web interface to trusted networks only.

OpenCVE Recommended Actions

  • Limit account creation to trusted individuals and remove unused accounts.
  • Enforce external authentication (LDAP, SAML, OIDC) with strict group mappings to control who can log in.
  • Monitor websocket subscriptions for abnormal patterns and deny subscriptions to event groups for objects outside the user’s organization.
  • Avoid embedding credentials in SCM or inventory source configurations; use credential objects instead.
  • Segment the network to restrict the AWX web interface to trusted networks only.

Generated by OpenCVE AI on August 4, 2026 at 00:03 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 22 Jul 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 22 Jul 2026 12:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate

Wed, 22 Jul 2026 11:45:00 +0000

Type Values Removed Values Added
Description A flaw was found in AWX. The websocket event consumer performs RBAC authorization checks only for event groups that are mapped in the consumer_access() function (job_events, workflow_events, ad_hoc_command_events). Three event groups - inventory_update_events, project_update_events, and system_job_events — are not mapped, causing the authorization check to be skipped. Any authenticated user can subscribe to these unmapped websocket event groups for any object ID and receive real-time stdout output from jobs belonging to organizations they have no access to. This is an incomplete remediation of CVE-2020-10698.
Title Awx: websocket eventconsumer missing authorization for inventory_update_events, project_update_events, and system_job_events allows cross-organization stdout disclosure
First Time appeared Redhat
Redhat ansible Automation Platform
Weaknesses CWE-862
CPEs cpe:/a:redhat:ansible_automation_platform:2
Vendors & Products Redhat
Redhat ansible Automation Platform
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Redhat Ansible Automation Platform
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2026-07-22T17:47:45.889Z

Reserved: 2026-07-22T09:58:35.294Z

Link: CVE-2026-16544

cve-icon Vulnrichment

Updated: 2026-07-22T17:47:41.623Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-07-22T12:17:10.480

Modified: 2026-07-22T18:16:59.987

Link: CVE-2026-16544

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-07-22T00:00:00Z

Links: CVE-2026-16544 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T00:15:04Z

Weaknesses