Critical SSRF Vulnerability in AWX Webhooks Exposes Git Credentials

A critical Server-Side Request Forgery (SSRF) vulnerability, identified as CVE-2026-71365, has been discovered in AWX, the upstream open-source project for Red Hat Ansible Tower. The vulnerability resides within AWX's webhook status callback mechanism, specifically when processing GitHub pull request webhooks. The core issue is that AWX extracts the `pull_request.statuses_url` from incoming webhook payloads without adequately validating the target host against the expected Git provider. This oversight allows for the manipulation of where status updates are sent. This vulnerability is significant because it enables an attacker, who has an administrative role on a webhook-enabled job template, to forge a signed GitHub webhook payload. By doing so, they can specify an arbitrary `statuses_url`, compelling AWX to send status updates to an attacker-controlled or internal URL. The critical impact stems from the fact that these status update requests inadvertently include the configured Git Personal Access Token (PAT) within the Authorization header. This results in the leakage of sensitive Git credentials to an endpoint controlled by the attacker, potentially compromising source code repositories and other connected systems. This incident fits into a broader, well-established trend in cloud and DevOps security: the increasing attack surface presented by highly integrated automation platforms. As organizations adopt more sophisticated CI/CD pipelines and leverage tools like AWX to orchestrate complex deployments, the interconnections between these tools (e.g., Git, cloud providers, monitoring systems) become potential vectors for attack. The reliance on webhooks for real-time communication, while efficient, introduces a need for stringent input validation and secure configuration management. This vulnerability highlights that even seemingly benign data points, like a callback URL, can be weaponized if not properly sanitized and authenticated, echoing past incidents where misconfigurations or flaws in integration points led to significant breaches. In practice, this means that organizations utilizing AWX, especially those with GitHub webhook integrations, must prioritize patching their AWX instances immediately to mitigate this risk. Beyond immediate remediation, practitioners should conduct a thorough audit of their AWX job templates, paying close attention to those configured with webhooks, and review the permissions granted to users managing these templates. Implementing the principle of least privilege for AWX administrators and ensuring that webhook configurations are locked down to only trusted endpoints are crucial steps. Furthermore, adopting a strategy of regularly rotating Git PATs and other sensitive credentials, coupled with continuous security scanning of automation infrastructure, will help guard against similar vulnerabilities in the future. This incident serves as a stark reminder that the security of automation platforms is paramount to the overall integrity of the software supply chain.