{"id":"CVE-2026-126642","kind":"vulnerability","aliases":["CVE-2026-126642"],"related":[],"title":"Red Hat AWX: template admins can steal other users' webhook credentials","description":"An incorrect authorization flaw was found in AWX, the automation controller component of Red Hat Ansible Automation Platform. The API access classes for JobTemplate and WorkflowJobTemplate do not check the caller's Credential use_role when assigning the single-valued webhook_credential foreign key: JobTemplateAccess.can_add/can_change and WorkflowJobTemplateAccess.can_change in awx/main/access.py omit the check_related('webhook_credential', Credential, ..., role_field='use_role') call that UnifiedCredentialsMixin.can_attach performs for the normal many-to-many credentials relationship, and the serializer validates only the credential's type and namespace. A user who may administer their own job template (or workflow job template) and use its project and inventory can therefore attach a webhook token credential (for example a GitLab token) that they do not have use permission on. The template administrator can retrieve the template's webhook key; a subsequent webhook event causes AWX to decrypt the attached token and send it in the request header (for GitLab, PRIVATE-TOKEN) to a status URL derived from the event payload, disclosing the victim's token to a destination the attacker can influence. This may disclose another user's personal access token and allow whatever actions that token permits.","summary":"AWX, the automation controller behind Red Hat Ansible Automation Platform, does not check whether a user may use a credential before attaching it to a job template's webhook. A template administrator can therefore attach another user's token, such as a GitLab personal access token, and have AWX send it to a URL the attacker can influence.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ansible-automation-platform","awx","gitlab","infrastructure","webhooks"],"not_affected_if":["no-webhook-credentials","single-admin-deployment"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-12T09:16:40+00:00","first_seen_at":"2026-11-12T09:37:34+00:00","triaged_at":"2026-11-12T09:39:10+00:00","updated_at":"2026-11-12T09:39:10+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-12T09:39:10Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Red Hat AWX: template admins can steal other users' webhook credentials","impact":"medium","summary":"AWX, the automation controller behind Red Hat Ansible Automation Platform, does not check whether a user may use a credential before attaching it to a job template's webhook. A template administrator can therefore attach another user's token, such as a GitLab personal access token, and have AWX send it to a URL the attacker can influence.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["awx","ansible-automation-platform","webhooks","gitlab"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"another user's personal access token is sent to an attacker-chosen host","analyst_note":"Affected and fixed AWX or Ansible Automation Platform versions are not in the sources; check the Red Hat advisory for CVE-2026-126642 and the AWX release notes.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-webhook-credentials","single-admin-deployment"],"who_is_affected":"Teams running AWX or Red Hat Ansible Automation Platform that use job template or workflow job template webhooks with stored webhook credentials. Exposure needs a user who can administer a job template and use its project and inventory, plus a webhook credential owned by another user. Installations without webhook credentials, or with only single-owner credentials, have less to lose.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000762,"input_tokens":4868,"output_tokens":551,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-126642':14A,17A '-2026':13A,16A 'access':70B,104C,272C 'action':277C 'add/can_change':130C 'admin':5A 'administ':176C 'administr':57B,213C 'allow':275C 'anoth':61B,268C 'ansibl':19B,33B,99C 'ansible-automation-platform':18B 'api':103C 'assign':120C 'attach':47B,60B,150C,193C,230C 'attack':81B,262C 'author':86C 'autom':20B,28B,34B,93C,100C 'awx':3A,22B,26B,74B,91C,226C 'awx/main/access.py':135C 'behind':30B 'call':147C 'caller':114C 'caus':225C 'chang':133C 'check':38B,112C,138C 'class':105C 'compon':95C 'control':29B,94C 'credenti':11A,45B,116C,126C,141C,142C,159C,167C,197C 'cve':12A,15A 'decrypt':228C 'deriv':248C 'destin':260C 'disclos':253C,267C 'event':224C,251C 'exampl':199C 'field':144C 'flaw':87C 'foreign':127C 'found':89C 'gitlab':23B,68B,201C,240C 'hat':2A,32B,98C 'header':238C 'incorrect':85C 'influenc':83B,264C 'infrastructur':24B 'inventori':190C 'job':51B,179C,183C 'jobtempl':107C 'jobtemplateaccess.can':129C 'key':128C,220C 'mani':156C,158C 'many-to-mani':155C 'may':42B,175C,266C 'namespac':171C 'normal':154C 'omit':136C 'payload':252C 'perform':151C 'permiss':209C 'permit':280C 'person':69B,271C 'platform':21B,35B,101C 'privat':242C 'private-token':241C 'project':188C 'red':1A,31B,97C 'relat':139C 'relationship':160C 'request':237C 'retriev':215C 'role':118C,143C,146C 'send':75B,233C 'serial':163C 'singl':123C 'single-valu':122C 'status':246C 'steal':7A 'subsequ':222C 'templat':4A,52B,56B,180C,184C,212C,217C 'therefor':59B,192C 'token':64B,71B,196C,202C,231C,243C,257C,273C,279C 'type':169C 'unifiedcredentialsmixin.can':149C 'url':79B,247C 'use':43B,117C,145C,186C,208C 'user':9A,41B,62B,173C,269C 'valid':164C 'valu':124C 'victim':255C 'webhook':10A,25B,54B,125C,140C,195C,219C,223C 'whatev':276C 'whether':39B 'workflow':182C 'workflowjobtempl':109C 'workflowjobtemplateaccess.can':132C","nicknames":[],"mitigations":[],"who_affected":"Teams running AWX or Red Hat Ansible Automation Platform that use job template or workflow job template webhooks with stored webhook credentials. Exposure needs a user who can administer a job template and use its project and inventory, plus a webhook credential owned by another user. Installations without webhook credentials, or with only single-owner credentials, have less to lose.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ansibleautomationplatform","awx","gitlab","infrastructure","medium","webhooks"],"campaign_type":null,"search_a":"'-126642':14A,17A '-2026':13A,16A 'admin':5A 'awx':3A 'credenti':11A 'cve':12A,15A 'hat':2A 'red':1A 'steal':7A 'templat':4A 'user':9A 'webhook':10A","search_b":"'access':70B 'administr':57B 'anoth':61B 'ansibl':19B,33B 'ansible-automation-platform':18B 'attach':47B,60B 'attack':81B 'autom':20B,28B,34B 'awx':22B,26B,74B 'behind':30B 'check':38B 'control':29B 'credenti':45B 'gitlab':23B,68B 'hat':32B 'influenc':83B 'infrastructur':24B 'job':51B 'may':42B 'person':69B 'platform':21B,35B 'red':31B 'send':75B 'templat':52B,56B 'therefor':59B 'token':64B,71B 'url':79B 'use':43B 'user':41B,62B 'webhook':25B,54B 'whether':39B","search_c":"'access':104C,272C 'action':277C 'add/can_change':130C 'administ':176C 'administr':213C 'allow':275C 'anoth':268C 'ansibl':99C 'api':103C 'assign':120C 'attach':150C,193C,230C 'attack':262C 'author':86C 'autom':93C,100C 'awx':91C,226C 'awx/main/access.py':135C 'call':147C 'caller':114C 'caus':225C 'chang':133C 'check':112C,138C 'class':105C 'compon':95C 'control':94C 'credenti':116C,126C,141C,142C,159C,167C,197C 'decrypt':228C 'deriv':248C 'destin':260C 'disclos':253C,267C 'event':224C,251C 'exampl':199C 'field':144C 'flaw':87C 'foreign':127C 'found':89C 'gitlab':201C,240C 'hat':98C 'header':238C 'incorrect':85C 'influenc':264C 'inventori':190C 'job':179C,183C 'jobtempl':107C 'jobtemplateaccess.can':129C 'key':128C,220C 'mani':156C,158C 'many-to-mani':155C 'may':175C,266C 'namespac':171C 'normal':154C 'omit':136C 'payload':252C 'perform':151C 'permiss':209C 'permit':280C 'person':271C 'platform':101C 'privat':242C 'private-token':241C 'project':188C 'red':97C 'relat':139C 'relationship':160C 'request':237C 'retriev':215C 'role':118C,143C,146C 'send':233C 'serial':163C 'singl':123C 'single-valu':122C 'status':246C 'subsequ':222C 'templat':180C,184C,212C,217C 'therefor':192C 'token':196C,202C,231C,243C,257C,273C,279C 'type':169C 'unifiedcredentialsmixin.can':149C 'url':247C 'use':117C,145C,186C,208C 'user':173C,269C 'valid':164C 'valu':124C 'victim':255C 'webhook':125C,140C,195C,219C,223C 'whatev':276C 'workflow':182C 'workflowjobtempl':109C 'workflowjobtemplateaccess.can':132C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T09:16:40+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126642","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126642","severity":null,"published_at":"2026-11-12T09:16:40+00:00","modified_at":"2026-11-12T09:16:40+00:00","first_seen_at":"2026-11-12T09:37:34+00:00","fetched_at":"2026-11-12T09:37:34+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}