{"id":"CVE-2026-71363","kind":"vulnerability","aliases":["CVE-2026-71363"],"related":[],"title":"AWX: unauthenticated debug endpoints let attackers exhaust resources and degrade service","description":"A flaw was found in AWX. The debug API endpoints (/api/debug/task_manager/, /api/debug/dependency_manager/, /api/debug/workflow_manager/) are registered unconditionally in the URL configuration and use AllowAny permission class with _ignore_model_permissions=True. This allows an unauthenticated remote attacker to repeatedly invoke scheduler operations that acquire database advisory locks and open transactions, potentially leading to resource exhaustion and degraded service availability.","summary":"AWX exposes debug API endpoints for its task, dependency and workflow managers without requiring authentication. An unauthenticated remote attacker can repeatedly trigger scheduler operations that take database locks and open transactions, which can exhaust resources and slow or disrupt the service.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["awx","kubernetes","other","self-hosted"],"not_affected_if":["network-restricted-api","no-public-access"],"how_to_check":"- Send an unauthenticated request to `/api/debug/task_manager/` on your AWX host and see whether it responds rather than returning an authentication error\n- Check the AWX version in use against the affected product ranges, which the sources do not list","fix":null,"status":"open","published_at":"2026-11-12T18:17:53+00:00","first_seen_at":"2026-11-12T18:40:39+00:00","triaged_at":"2026-11-12T18:43:02+00:00","updated_at":"2026-11-12T18:43:02+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-12T18:43:02Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"AWX: unauthenticated debug endpoints let attackers exhaust resources and degrade service","impact":"medium","summary":"AWX exposes debug API endpoints for its task, dependency and workflow managers without requiring authentication. An unauthenticated remote attacker can repeatedly trigger scheduler operations that take database locks and open transactions, which can exhaust resources and slow or disrupt the service.","audience":"businesses","category":"other","nicknames":[],"who_cares":["awx","self-hosted","kubernetes"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"service degradation or outage from repeated scheduler requests","analyst_note":"Confirm affected and fixed AWX versions from the NVD entry or the upstream AWX repository, and whether the debug routes are removed or gated in a release.","how_to_check":"- Send an unauthenticated request to `/api/debug/task_manager/` on your AWX host and see whether it responds rather than returning an authentication error\n- Check the AWX version in use against the affected product ranges, which the sources do not list\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["network-restricted-api","no-public-access"],"who_is_affected":"AWX instances that are reachable over a network, since the debug endpoints are registered in the URL configuration regardless of settings and accept requests without any login. Installations where the AWX API is not reachable from untrusted networks are much less exposed. The sources do not state which AWX versions are affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000748,"input_tokens":4592,"output_tokens":578,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-71363':14A,17A '/api/debug/dependency_manager':76C '/api/debug/task_manager':75C '/api/debug/workflow_manager':77C 'acquir':107C 'advisori':109C 'allow':96C 'allowani':87C 'api':27B,73C 'attack':6A,42B,100C 'authent':38B 'avail':122C 'awx':1A,18B,24B,70C 'class':89C 'configur':84C 'cve':12A,15A 'databas':50B,108C 'debug':3A,26B,72C 'degrad':10A,120C 'depend':32B 'disrupt':62B 'endpoint':4A,28B,74C 'exhaust':7A,57B,118C 'expos':25B 'flaw':66C 'found':68C 'host':23B 'ignor':91C 'invok':103C 'kubernet':19B 'lead':115C 'let':5A 'lock':51B,110C 'manag':35B 'model':92C 'open':53B,112C 'oper':47B,105C 'permiss':88C,93C 'potenti':114C 'regist':79C 'remot':41B,99C 'repeat':44B,102C 'requir':37B 'resourc':8A,58B,117C 'schedul':46B,104C 'self':22B 'self-host':21B 'servic':11A,64B,121C 'slow':60B 'take':49B 'task':31B 'transact':54B,113C 'trigger':45B 'true':94C 'unauthent':2A,40B,98C 'uncondit':80C 'url':83C 'use':86C 'without':36B 'workflow':34B","nicknames":[],"mitigations":[],"who_affected":"AWX instances that are reachable over a network, since the debug endpoints are registered in the URL configuration regardless of settings and accept requests without any login. Installations where the AWX API is not reachable from untrusted networks are much less exposed. The sources do not state which AWX versions are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["awx","kubernetes","medium","other","selfhosted"],"campaign_type":null,"search_a":"'-2026':13A,16A '-71363':14A,17A 'attack':6A 'awx':1A 'cve':12A,15A 'debug':3A 'degrad':10A 'endpoint':4A 'exhaust':7A 'let':5A 'resourc':8A 'servic':11A 'unauthent':2A","search_b":"'api':27B 'attack':42B 'authent':38B 'awx':18B,24B 'databas':50B 'debug':26B 'depend':32B 'disrupt':62B 'endpoint':28B 'exhaust':57B 'expos':25B 'host':23B 'kubernet':19B 'lock':51B 'manag':35B 'open':53B 'oper':47B 'remot':41B 'repeat':44B 'requir':37B 'resourc':58B 'schedul':46B 'self':22B 'self-host':21B 'servic':64B 'slow':60B 'take':49B 'task':31B 'transact':54B 'trigger':45B 'unauthent':40B 'without':36B 'workflow':34B","search_c":"'/api/debug/dependency_manager':76C '/api/debug/task_manager':75C '/api/debug/workflow_manager':77C 'acquir':107C 'advisori':109C 'allow':96C 'allowani':87C 'api':73C 'attack':100C 'avail':122C 'awx':70C 'class':89C 'configur':84C 'databas':108C 'debug':72C 'degrad':120C 'endpoint':74C 'exhaust':118C 'flaw':66C 'found':68C 'ignor':91C 'invok':103C 'lead':115C 'lock':110C 'model':92C 'open':112C 'oper':105C 'permiss':88C,93C 'potenti':114C 'regist':79C 'remot':99C 'repeat':102C 'resourc':117C 'schedul':104C 'servic':121C 'transact':113C 'true':94C 'unauthent':98C 'uncondit':80C 'url':83C 'use':86C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T18:17:53+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-71363","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71363","severity":null,"published_at":"2026-11-12T18:17:53+00:00","modified_at":"2026-11-12T18:17:53+00:00","first_seen_at":"2026-11-12T18:40:39+00:00","fetched_at":"2026-11-12T18:40:39+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}