CVE-2026-16544

Отчет

This flaw affects all versions of Ansible Automation Platform that ship the Controller component (formerly Ansible Tower). The websocket RBAC mechanism was introduced as part of the fix for CVE-2020-10698, but the consumer_access() function was never updated to cover all subscribable event groups. Exploitation requires a valid authenticated user account on the AWX/Controller instance, but no specific role or organization membership is needed. The attacker receives stdout and event metadata in real time for inventory updates, project updates, and system jobs across all organizations. In multi-tenant deployments (including managed services), this allows one tenant's users to observe another tenant's job output.

Меры по смягчению последствий

The following practices would help for avoiding exposure and mitigate this flaw:

• Restrict AWX/Controller user account creation to only trusted individuals. Since any authenticated user can exploit this flaw regardless of role, minimizing the number of user accounts reduces the attack surface.
• Use external authentication (LDAP, SAML, OIDC) with strict group mappings to prevent self-registration and ensure only authorized users can log in.
• Review the list of AWX/Controller users and remove or deactivate any accounts that are no longer needed.
• Monitor websocket connections and subscriptions for unusual patterns, such as a user subscribing to inventory_update_events or project_update_events for object IDs outside their organization.
• Avoid embedding credentials in SCM URLs or inventory source configurations, as these may appear in stdout output. Use credential objects instead.
• Apply network segmentation to restrict access to the AWX/Controller web interface to trusted networks only.