CVE Feed

    Dashboard / CVE / CVE-2026-71363

    CVE-2026-71363

    A flaw was found in AWX. The debug API endpoints (/api/debug/task_manager/, /api/debug/dependency_manager/, /api/debug/workflow_manager/) are registered unconditionally in the URL configuration and use AllowAny permission class with _ignore_model_permissions=True. This allows an unauthenticated remote attacker to repeatedly invoke scheduler operations that acquire database advisory locks and open transactions, potentially leading to resource exhaustion and degraded service availability.

    Published:Nov 12, 2026
    Last Modified:Nov 12, 2026
    EPS:Nov 12, 2026
    EPSS Score:
    CVSS Score:5.3

    Affected Products

    Vendor
    Redhat
    Product
    Ansible Automation Platform

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-71367 (CVSS 4.3) — An incorrect authorization vulnerability was found in AWX's WebSocket consumer. The consumer_access() function…
    CVE-2026-126643 (CVSS 6.5) — A cleartext storage flaw was found in the AAP Gateway Operator. When reconciling an AutomationController, the …
    CVE-2026-126642 (CVSS 6.5) — An incorrect authorization flaw was found in AWX, the automation controller component of Red Hat Ansible Autom…
    CVE-2026-126641 (CVSS 6.5) — A host key verification flaw was found in ansible-pylibssh and in the ansible.netcommon libssh connection plug…
    CVE-2026-123084 (CVSS 6.5) — An **expression language injection** has been found in the HeaderContentGuard.permit function in publication.p…
    CVE-2026-125063 (CVSS 4.3) — A flaw was found in the rrule validation of schedules in automation controller. Several non-anchored regular e…
    CVE-2026-123037 (CVSS 6.7) — A flaw was found in the ansible-core user module. When generate_ssh_key is enabled, User.ssh_key_gen() guards …
    CVE-2026-84503 (CVSS 6.7) — A flaw was found in ansible-core's ansible.builtin.git module. The module invokes git (ls-remote, clone, fetch…
    CVE-2026-114236 (CVSS 3.3) — storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, le…
    CVE-2026-109131 (CVSS 5.4) — The Hub collection module documentation renderer in the unified Ansible Automation Platform UI (built from ups…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High