HackZoneLabs News
Newsletter

CVE-2026-71363

Awx: unauthenticated debug endpoints trigger scheduler operations

  • Medium 5.3

Description

A flaw was found in AWX. The debug API endpoints (/api/debug/task_manager/, /api/debug/dependency_manager/, /api/debug/workflow_manager/) are registered unconditionally in the URL configuration and use AllowAny permission class with _ignore_model_permissions=True. This allows an unauthenticated remote attacker to repeatedly invoke scheduler operations that acquire database advisory locks and open transactions, potentially leading to resource exhaustion and degraded service availability.

Key facts

Published
12 Nov 2026
Last changed
13 Nov 2026
Assigned by
redhat
EPSS
0.332% likely to be exploited in the next 30 days, higher than 26.754% of CVEs (scores for 15 Nov 2026)
SSVC (CISA)
Exploitation: none; Automatable: no; Technical impact: partial

Severity scores

Each score is shown as its source gave it. They are not averaged or merged.

  • 5.3CVSS 3.1, Mediumfrom the CNA (redhat)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

What to do

  • There is no complete mitigation for this vulnerability other than applying the update when available. However, the following measures reduce exposure: 1. Restrict network access to the Automation Controller API (/api/) to trusted networks and authenticated clients using firewall rules or reverse proxy configuration. 2. Configure a reverse proxy or web application firewall to block requests to /api/debug/* paths. 3. In AAP 2.5+ deployments, ensure that the Automation Controller API is not directly accessible bypassing the Platform Gateway.CNA workaround statement

Historical context and remediation

This reference retains the original CVE publication date. A recent record update does not mean a new attack occurred.

No separately sourced impact summary is available on this page yet. Consult the description, version data and dated exploitation evidence.

Version statuses below come from the CNA. An “unaffected” version is not necessarily a currently supported release or proof of a patch date. EPSS is a dated risk estimate, not a count of historical attacks.

Read the original CVE record.

Affected products

VendorProductVersions
Red HatRed Hat Ansible Automation Platform 2
  • Default status: affected
Red HatRed Hat Ansible Automation Platform 2
  • Default status: affected
Red HatRed Hat Ansible Automation Platform 2
  • Default status: affected

Timeline

  1. 6 Aug 2026 Reported to Red Hat.
  2. 12 Nov 2026 Made public.
  3. 12 Nov 2026 Published

Weakness

References