EUVD-2026-47629

A flaw was found in AWX. The websocket event consumer performs RBAC authorization checks only for event groups that are mapped in the consumeraccess function jobevents, workflowevents, adhoccommandevents. Three event groups - inventoryupdateevents, projectupdateevents, and systemjobevents — are n...

CVE-2026-16544

A flaw was found in AWX. The websocket event consumer performs RBAC authorization checks only for event groups that are mapped in the consumeraccess function jobevents, workflowevents, adhoccommandevents. Three event groups - inventoryupdateevents, projectupdateevents, and systemjobevents — are n...

CVE-2026-12726

A flaw was found in the AWX GitHub webhook integration. When processing GitHub pullrequest webhooks, the controller stores the pullrequest.statusesurl value from the webhook payload without validating that it points to a trusted GitHub API endpoint. If a job template is configured with a GitHub...

CVE-2026-12726

A flaw was found in the AWX GitHub webhook integration. When processing GitHub pullrequest webhooks, the controller stores the pullrequest.statusesurl value from the webhook payload without validating that it points to a trusted GitHub API endpoint. If a job template is configured with a GitHub...

EUVD-2026-38065

A flaw was found in the AWX GitHub webhook integration. When processing GitHub pullrequest webhooks, the controller stores the pullrequest.statusesurl value from the webhook payload without validating that it points to a trusted GitHub API endpoint. If a job template is configured with a GitHub...

CVE-2026-12726 Awx: automation-controller: awx: github webhook second-order ssrf via unvalidated statuses_url exfiltrates pat credential

A flaw was found in the AWX GitHub webhook integration. When processing GitHub pullrequest webhooks, the controller stores the pullrequest.statusesurl value from the webhook payload without validating that it points to a trusted GitHub API endpoint. If a job template is configured with a GitHub...

CVE-2026-12726

AWX/AUTOMATION-CONTROLLER GitHub webhook integration vulnerability (CVE-2026-12726): processing of GitHub pull_request webhooks stores statuses_url from the payload without validating it points to a trusted GitHub API endpoint. If a job template uses a GitHub Personal Access Token as the webhook ...

PT-2026-51010

Name of the Vulnerable Software and Affected Versions AWX affected versions not specified Description A flaw exists in the GitHub webhook integration where the controller stores the pull request.statuses url value from a pull request webhook payload without validating if it points to a trusted...

awx-mcp-server (>=1.1.3, <=1.2.0), broker (>=0.0.0, <=0.6.12) +1 more potentially affected by CVE-2026-52902 via awxkit (>=23.9.0, <=24.6.1)

awxkit PYPI version =23.9.0, =1.1.3, =0.0.0, =1.5.0, =2.0.1 Source cves: CVE-2026-52902 Source advisory: SNYK:PYTHON-AWXKIT-17339772...

CVE-2026-52902

CVE-2026-52902 affects awxkit (AWX CLI). The YAML !include directive permits path traversal, enabling an attacker to craft a YAML file that reads arbitrary local YAML files when a user imports it via awx --conf.format yaml import. This is a client-side vulnerability requiring user interaction. Mi...

GHSA-MV93-W799-CJ2W vulnerabilities

Vulnerabilities for packages: datahub-ingestion-fips, jupyter-all-spark-notebook, mlflow, awx, opal, mlflow-fips, nemo...

GHSA-9F5J-8JWJ-X28G vulnerabilities

Vulnerabilities for packages: awx, airflow...

CVE-2026-33936 vulnerabilities

Vulnerabilities for packages: awx, airflow...

GHSA-PXRR-HQ57-Q35P vulnerabilities

Vulnerabilities for packages: awx...

CVE-2026-33154 vulnerabilities

Vulnerabilities for packages: awx...

CVE-2025-69534 vulnerabilities

Vulnerabilities for packages: awx, superset...

GHSA-5WMX-573V-2QWQ vulnerabilities

Vulnerabilities for packages: awx, superset...

CVE-2025-69229 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines-visualization-server, dask-kubernetes, apache-beam-python-3.11-sdk, airflow, awx, request-1276, open-webui, checkov, authentik, py3-vllm-cuda-12.4, kserve, py3-cassandra-medusa, py3.13-scanner-test-libraries-aiohttp...

GHSA-6MQ8-RVHQ-8WGG vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines-visualization-server, dask-kubernetes, apache-beam-python-3.11-sdk, airflow, awx, request-1276, open-webui, checkov, authentik, py3-vllm-cuda-12.4, kserve, py3-cassandra-medusa, py3.13-scanner-test-libraries-aiohttp...

GHSA-6JHG-HG63-JVVF vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines-visualization-server, dask-kubernetes, apache-beam-python-3.11-sdk, airflow, awx, request-1276, open-webui, checkov, authentik, py3-vllm-cuda-12.4, kserve, py3-cassandra-medusa, py3.13-scanner-test-libraries-aiohttp...