CVE-2026-71367 · Infrastructure
NO FIX YET
AWX, the open-source Ansible automation controller, does not check permissions on one of its global WebSocket broadcast groups, so an authenticated user can subscribe to it. The subscriber then receives job IDs, status changes, timestamps and instance group names from every organization, bypassing the isolation the REST API enforces.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Multi-organization AWX deployments where some users belong to organizations that should not see each other's jobs. Single-organization deployments have less to lose, since the data exposed is cross-organization. The sources give no affected version range.
Not affected if managed-hosting, single-organization
Who cares ansible, awx, kubernetes, self-hosted
No fix yet, per the sources.
An incorrect authorization vulnerability was found in AWX's WebSocket consumer. The consumer_access() function only enforces access controls for object-level event groups (job_events, workflow_events, ad_hoc_command_events) but does not restrict subscriptions to global broadcast groups such as 'jobs-status_changed'. When an authenticated user subscribes to a global broadcast group, the server accepts the subscription without verifying that the user has permission to view the associated resources. In multi-organization deployments, this allows a low-privilege user in one organization to receive real-time job status metadata from all organizations, including job IDs, status transitions, timestamps, and infrastructure topology details such as instance group names, bypassing the organization isolation enforced by the REST API.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.