PT-2026-51010 · Red Hat · Red Hat Ansible Automation Platform 2

Publicado 2026-06-19 · Atualizado 2026-06-19 · CVE-2026-12726

Mitre

CVSS v3.1

6.3

Média

Vetor base

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

A flaw was found in the AWX GitHub webhook integration. When processing GitHub pull request webhooks, the controller stores the pull request.statuses url value from the webhook payload without validating that it points to a trusted GitHub API endpoint. If a job template is configured with a GitHub Personal Access Token as its webhook credential, the controller later POSTs that token to the stored callback URL when posting job status updates. An attacker who can submit a correctly signed forged webhook using the job template's webhook key can redirect the callback to an attacker-controlled URL and exfiltrate the configured GitHub PAT.

Correção

SSRF

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

CVE-2026-12726

Produtos afetados

Red Hat Ansible Automation Platform 2

Referências · 3

• https://bugzilla.redhat.com/show_bug.cgi?id=2490796 · Nota
• https://access.redhat.com/security/cve/CVE-2026-12726 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-12726 · Nota de Segurança