The vulnerability is a server‑side request forgery in several AWX notification backends, such as webhook, Mattermost, Rocket.Chat, and Grafana. The backends use notification template URLs as direct HTTP request targets without validating whether the target address is a private, loopback, or reserved IP range. An organization notification administrator can therefore create or modify templates that point to internal or loopback addresses, which causes the AWX control node to issue HTTP requests to services that are not externally reachable. In addition, the webhook backend follows HTTP redirects and re‑sends configured Basic Authentication credentials to the redirect target regardless of host change, allowing an attacker to exfiltrate notification credentials by redirecting to an attacker‑controlled host. The Grafana backend sends its API key in the Authorization header to the configured target URL, further exposing sensitive credentials. This combination enables an attacker to gain confidential information and potentially access internal systems.

The affected product is Red Hat Ansible Automation Platform 2, the AWX component that runs the notification backends. The CNA list does not specify more granular version information; all instances of the platform are considered vulnerable.

The CVSS score of 7.7 indicates a moderate‑to‑high severity bug. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting no documented exploitation yet. The likely attack vector requires an attacker to have sufficient privileges to create or modify notification templates, which usually means a trusted administrator. Once such privileges are exercised, the attacker can load internal services or redirect requests to move confidential credentials outside the network, posing a substantial confidentiality risk. The absence of a public exploit at the time of analysis does not mitigate the likelihood that a motivated adversary with admin access could leverage the flaw.