CVE-2026-71363 · Other
NO FIX YET
AWX exposes debug API endpoints for its task, dependency and workflow managers without requiring authentication. An unauthenticated remote attacker can repeatedly trigger scheduler operations that take database locks and open transactions, which can exhaust resources and slow or disrupt the service.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
AWX instances that are reachable over a network, since the debug endpoints are registered in the URL configuration regardless of settings and accept requests without any login. Installations where the AWX API is not reachable from untrusted networks are much less exposed. The sources do not state which AWX versions are affected.
Not affected if network-restricted-api, no-public-access
Who cares awx, kubernetes, self-hosted
/api/debug/task_manager/ on your AWX host and see whether it responds rather than returning an authentication errorNo fix yet, per the sources.
A flaw was found in AWX. The debug API endpoints (/api/debug/task_manager/, /api/debug/dependency_manager/, /api/debug/workflow_manager/) are registered unconditionally in the URL configuration and use AllowAny permission class with _ignore_model_permissions=True. This allows an unauthenticated remote attacker to repeatedly invoke scheduler operations that acquire database advisory locks and open transactions, potentially leading to resource exhaustion and degraded service availability.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.