CVE-2026-71367
Awx: websocket broadcast groups leak cross-organization job metadata
- Medium 4.3
Description
An incorrect authorization vulnerability was found in AWX's WebSocket consumer. The consumer_access() function only enforces access controls for object-level event groups (job_events, workflow_events, ad_hoc_command_events) but does not restrict subscriptions to global broadcast groups such as 'jobs-status_changed'. When an authenticated user subscribes to a global broadcast group, the server accepts the subscription without verifying that the user has permission to view the associated resources. In multi-organization deployments, this allows a low-privilege user in one organization to receive real-time job status metadata from all organizations, including job IDs, status transitions, timestamps, and infrastructure topology details such as instance group names, bypassing the organization isolation enforced by the REST API.
Key facts
- Published
- 12 Nov 2026
- Last changed
- 12 Nov 2026
- Assigned by
- redhat
- EPSS
- 0.365% likely to be exploited in the next 30 days, higher than 30.812% of CVEs (scores for 15 Nov 2026)
- SSVC (CISA)
- Exploitation: none; Automatable: no; Technical impact: partial
Severity scores
Each score is shown as its source gave it. They are not averaged or merged.
- 4.3CVSS 3.1, Mediumfrom the CNA (redhat)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
What to do
- There is no complete mitigation for this vulnerability other than applying the update when available. However, the following measures reduce exposure: 1. In multi-organization deployments, restrict user account creation to necessary personnel and audit user organization memberships. 2. If a reverse proxy or load balancer is in front of the Controller, consider restricting WebSocket upgrade requests (/websocket/) to authenticated sessions with known legitimate use cases. 3. For managed service deployments, engage the managed services team to assess whether additional network-level WebSocket filtering can be applied at the service mesh layer. 4. Monitor WebSocket subscription activity for users subscribing to broadcast groups outside their organization scope.CNA workaround statement
Historical context and remediation
This reference retains the original CVE publication date. A recent record update does not mean a new attack occurred.
No separately sourced impact summary is available on this page yet. Consult the description, version data and dated exploitation evidence.
Version statuses below come from the CNA. An “unaffected” version is not necessarily a currently supported release or proof of a patch date. EPSS is a dated risk estimate, not a count of historical attacks.
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat Ansible Automation Platform 2 |
|
| Red Hat | Red Hat Ansible Automation Platform 2 |
|
| Red Hat | Red Hat Ansible Automation Platform 2 |
|
Timeline
- 6 Aug 2026 Reported to Red Hat.
- 12 Nov 2026 Made public.
- 12 Nov 2026 Published