CVE-2026-71363

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-71363", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2026-08-06T04:27:34.372Z", "datePublished": "2026-11-12T17:19:27.585Z", "dateUpdated": "2026-11-13T18:56:05.898Z"}, "containers": {"cna": {"title": "Awx: unauthenticated debug endpoints trigger scheduler operations", "metrics": [{"other": {"content": {"value": "Moderate", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "A flaw was found in AWX. The debug API endpoints (/api/debug/task_manager/, /api/debug/dependency_manager/, /api/debug/workflow_manager/) are registered unconditionally in the URL configuration and use AllowAny permission class with _ignore_model_permissions=True. This allows an unauthenticated remote attacker to repeatedly invoke scheduler operations that acquire database advisory locks and open transactions, potentially leading to resource exhaustion and degraded service availability."}], "affected": [{"vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-automation-platform-26/controller-rhel9", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:ansible_automation_platform:2"]}, {"vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-automation-platform-27/controller-rhel9", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:ansible_automation_platform:2"]}, {"vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "automation-controller", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:ansible_automation_platform:2"]}], "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-71363", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511899", "name": "RHBZ#2511899", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "datePublic": "2026-11-12T13:23:11.781Z", "problemTypes": [{"descriptions": [{"cweId": "CWE-306", "description": "Missing Authentication for Critical Functionality", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-306: Missing Authentication for Critical Functionality", "workarounds": [{"lang": "en", "value": "There is no complete mitigation for this vulnerability other than applying the update when available. However, the following measures reduce exposure:\n\n1. Restrict network access to the Automation Controller API (/api/) to trusted networks and authenticated clients using firewall rules or reverse proxy configuration.\n2. Configure a reverse proxy or web application firewall to block requests to /api/debug/* paths.\n3. In AAP 2.5+ deployments, ensure that the Automation Controller API is not directly accessible bypassing the Platform Gateway."}], "timeline": [{"lang": "en", "time": "2026-08-06T00:00:00.000Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-11-12T13:23:11.781Z", "value": "Made public."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-11-12T17:19:27.585Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-13T18:54:43.688981Z", "id": "CVE-2026-71363", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-13T18:56:05.898Z"}}]}}

{}

{"affected": [{"affectedData": [{"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:ansible_automation_platform:2"], "defaultStatus": "affected", "packageName": "ansible-automation-platform-26/controller-rhel9", "product": "Red Hat Ansible Automation Platform 2", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:ansible_automation_platform:2"], "defaultStatus": "affected", "packageName": "ansible-automation-platform-27/controller-rhel9", "product": "Red Hat Ansible Automation Platform 2", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:ansible_automation_platform:2"], "defaultStatus": "affected", "packageName": "automation-controller", "product": "Red Hat Ansible Automation Platform 2", "vendor": "Red Hat"}], "source": "secalert@redhat.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw was found in AWX. The debug API endpoints (/api/debug/task_manager/, /api/debug/dependency_manager/, /api/debug/workflow_manager/) are registered unconditionally in the URL configuration and use AllowAny permission class with _ignore_model_permissions=True. This allows an unauthenticated remote attacker to repeatedly invoke scheduler operations that acquire database advisory locks and open transactions, potentially leading to resource exhaustion and degraded service availability."}], "id": "CVE-2026-71363", "lastModified": "2026-11-13T19:19:36.353", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "secalert@redhat.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-71363", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-13T18:54:43.688981Z", "version": "2.0.3"}}]}, "published": "2026-11-12T18:17:53.270", "references": [{"source": "secalert@redhat.com", "url": "https://access.redhat.com/security/cve/CVE-2026-71363"}, {"source": "secalert@redhat.com", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511899"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-306"}], "source": "secalert@redhat.com", "type": "Secondary"}]}

{"bugzilla": {"description": "awx: unauthenticated debug endpoints trigger scheduler operations", "id": "2511899", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511899"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "status": "draft"}, "cwe": "CWE-306", "details": ["A flaw was found in AWX. The debug API endpoints (/api/debug/task_manager/, /api/debug/dependency_manager/, /api/debug/workflow_manager/) are registered unconditionally in the URL configuration and use AllowAny permission class with _ignore_model_permissions=True. This allows an unauthenticated remote attacker to repeatedly invoke scheduler operations that acquire database advisory locks and open transactions, potentially leading to resource exhaustion and degraded service availability."], "mitigation": {"lang": "en:us", "value": "There is no complete mitigation for this vulnerability other than applying the update when available. However, the following measures reduce exposure:\n1. Restrict network access to the Automation Controller API (/api/) to trusted networks and authenticated clients using firewall rules or reverse proxy configuration.\n2. Configure a reverse proxy or web application firewall to block requests to /api/debug/* paths.\n3. In AAP 2.5+ deployments, ensure that the Automation Controller API is not directly accessible bypassing the Platform Gateway."}, "name": "CVE-2026-71363", "package_state": [{"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Fix deferred", "package_name": "ansible-automation-platform-26/controller-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Fix deferred", "package_name": "ansible-automation-platform-27/controller-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Fix deferred", "impact": "moderate", "package_name": "automation-controller", "product_name": "Red Hat Ansible Automation Platform 2"}], "public_date": "2026-11-12T13:23:11Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-71363\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-71363"], "statement": "Red Hat has assessed this vulnerability as Moderate impact. The debug endpoints allow unauthenticated callers to trigger scheduler operations that would otherwise run on a periodic timer. While the lack of authentication is a security defect, the practical impact is limited to service degradation through lock contention under sustained attack. The scheduler's advisory locking mechanism serializes concurrent invocations, preventing true parallel execution and limiting the resource consumption per request. In Red Hat Ansible Automation Platform 2.5 and later, the Platform Gateway provides an additional authentication layer in front of the Automation Controller API, which may prevent unauthenticated access to these endpoints depending on deployment configuration. Customers are advised to restrict network access to the Automation Controller API to trusted networks.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Red Hat Ansible Automation Platform 2", "source": "cna", "vendor": "Red Hat"}, "product": "ansible_automation_platform", "vendor": "redhat"}], "created": "2026-11-13T12:30:04.681818+00:00", "updated": "2026-11-13T12:30:04.681875+00:00", "vendors": ["redhat", "redhat$PRODUCT$ansible_automation_platform"]}