CVE-2026-12726— Awx: automation-controller: awx: github webhook second-order ssrf via unvalidated statuses_url exfiltrates pat credential
Possible ATT&CK Techniques 2AI
T1190 · Exploit Public-Facing Application T1530 · Data from Cloud StorageAffected Version Matrix 3
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Red Hat | Red Hat Ansible Automation Platform 2 | any | affected |
any | affected | ||
any | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-12726
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Awx: automation-controller: awx: github webhook second-order ssrf via unvalidated statuses_url exfiltrates pat credential
Source: NVD (National Vulnerability Database)
Vulnerability Description
A flaw was found in the AWX GitHub webhook integration. When processing GitHub pull_request webhooks, the controller stores the pull_request.statuses_url value from the webhook payload without validating that it points to a trusted GitHub API endpoint. If a job template is configured with a GitHub Personal Access Token as its webhook credential, the controller later POSTs that token to the stored callback URL when posting job status updates. An attacker who can submit a correctly signed forged webhook using the job template's webhook_key can redirect the callback to an attacker-controlled URL and exfiltrate the configured GitHub PAT.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
服务端请求伪造(SSRF)
Source: NVD (National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Red Hat | Red Hat Ansible Automation Platform 2 | - | cpe:/a:redhat:ansible_automation_platform:2 | |
| Red Hat | Red Hat Ansible Automation Platform 2 | - | cpe:/a:redhat:ansible_automation_platform:2 | |
| Red Hat | Red Hat Ansible Automation Platform 2 | - | cpe:/a:redhat:ansible_automation_platform:2 |
II. Public POCs for CVE-2026-12726
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-12726
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-12726 (1)
Other References for CVE-2026-12726 (1)
Same Patch Batch · Red Hat · 2026-06-19 · 6 CVEs total
| CVE-2026-56208 | 7.6 HIGH | Libaom: libaom: heap buffer overflow in av1 encoder first-pass stats buffer via lap mode |
| CVE-2026-56211 | 7.1 HIGH | Libaom: libaom: remote code execution via svc layer context handling with attacker-control |
| CVE-2026-56210 | 7.1 HIGH | Libaom: libaom: heap-buffer-overflow read via missing bounds check in ctrl_set_layer_id |
| CVE-2026-56209 | 7.1 HIGH | Libaom: libaom: arbitrary address write via svc layer context oob and cyclic refresh map p |
| CVE-2026-12706 | 6.5 MEDIUM | Ffmpeg: ffmpeg: heap use-after-free read in rasc decoder decode_move() |
IV. Related Vulnerabilities
Same product: Red Hat Ansible Automation Platform 2
- CVE-2026-12398
Galaxy_ng: shell injection in legacy role import via unsanit - CVE-2026-52902
Awxkit: path traversal via yaml !include directive - CVE-2026-11332
Ansible-core: argument injection in ansible-galaxy role inst - CVE-2026-6494
Aap-mcp-server: aap mcp server: log injection allows social - CVE-2025-57847
Ansible-automation-platform: privilege escalation via excess
Same vendor: Red Hat
- CVE-2026-56211
Libaom: libaom: remote code execution via svc layer context - CVE-2026-56210
Libaom: libaom: heap-buffer-overflow read via missing bounds - CVE-2026-56209
Libaom: libaom: arbitrary address write via svc layer contex - CVE-2026-56208
Libaom: libaom: heap buffer overflow in av1 encoder first-pa - CVE-2026-12706
Ffmpeg: ffmpeg: heap use-after-free read in rasc decoder dec
Same weakness: CWE-918
- CVE-2026-49345
Mercator CVE Configuration Vulnerable to Server-Side Request - CVE-2026-49359
PhpWeasyPrint vulnerable to SSRF and local file disclosure v - CVE-2026-11989
Bit integrations <= 2.8.7 - Unauthenticated Server-Side Requ - CVE-2026-4328
Advanced Import: One-Click Demo Import for WordPress <= 1.4. - CVE-2026-11395
CF7 to Webhook <= 5.0.0 - Unauthenticated Server-Side Reques
V. Comments for CVE-2026-12726
No comments yet