---
id: "CVE-2026-71363"
page: "https://infrastack.ai/live/CVE-2026-71363"
kind: "vulnerability"
aliases: ["CVE-2026-71363"]
title: "AWX: unauthenticated debug endpoints let attackers exhaust resources and degrade service"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["awx", "kubernetes", "other", "self-hosted"]
not_affected_if: ["network-restricted-api", "no-public-access"]
published_at: "2026-11-12T18:17:53+00:00"
first_seen_at: "2026-11-12T18:40:39+00:00"
updated_at: "2026-11-12T18:43:02+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-71363", "first_seen_at": "2026-11-12T18:40:39+00:00"}]
exploit_sources: []
---

# AWX: unauthenticated debug endpoints let attackers exhaust resources and degrade service

Link for people: https://infrastack.ai/live/CVE-2026-71363 (this .md is for agents)

AWX exposes debug API endpoints for its task, dependency and workflow managers without requiring authentication. An unauthenticated remote attacker can repeatedly trigger scheduler operations that take database locks and open transactions, which can exhaust resources and slow or disrupt the service.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Send an unauthenticated request to `/api/debug/task_manager/` on your AWX host and see whether it responds rather than returning an authentication error
- Check the AWX version in use against the affected product ranges, which the sources do not list

## Timeline

- 2026-11-12T18:40:39+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-71363

## From the sources

A flaw was found in AWX. The debug API endpoints (/api/debug/task_manager/, /api/debug/dependency_manager/, /api/debug/workflow_manager/) are registered unconditionally in the URL configuration and use AllowAny permission class with _ignore_model_permissions=True. This allows an unauthenticated remote attacker to repeatedly invoke scheduler operations that acquire database advisory locks and open transactions, potentially leading to resource exhaustion and degraded service availability.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_