Answer in brief
CVE-2026-126642 records a Medium severity (CVSS 6.5) vulnerability in Awx: webhook credential assignment omits use_role check, exposing another user's token. The current sources do not mark it as known exploited. The current feed maps Red Hat/ansible-automation-platform-24/controller-rhel8 (generic), Red Hat/ansible-automation-platform-25/controller-rhel8 (generic), Red Hat/ansible-automation-platform-26/controller-rhel9 (generic), Red Hat/ansible-automation-platform-27/controller-rhel9 (generic) and additional mapped packages. Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 6.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Red Hat/ansible-automation-platform-24/controller-rhel8 (generic), Red Hat/ansible-automation-platform-25/controller-rhel8 (generic), Red Hat/ansible-automation-platform-26/controller-rhel9 (generic), Red Hat/ansible-automation-platform-27/controller-rhel9 (generic) and additional mapped packages. Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Red Hat/ansible-automation-platform-24/controller-rhel8generic | * | Not reported |
| Red Hat/ansible-automation-platform-25/controller-rhel8generic | * | Not reported |
| Red Hat/ansible-automation-platform-26/controller-rhel9generic | * | Not reported |
| Red Hat/ansible-automation-platform-27/controller-rhel9generic | * | Not reported |
| Red Hat/automation-controllergeneric | * | Not reported |
Published upstream
Nov 12, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Nov 12, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Nov 12, 2026
An incorrect authorization flaw was found in AWX, the automation controller component of Red Hat Ansible Automation Platform. The API access classes for JobTemplate and WorkflowJobTemplate do not check the caller's Credential use_role when assigning the single-valued webhook_credential foreign key: JobTemplateAccess.can_add/can_change and WorkflowJobTemplateAccess.can_change in awx/main/access.py omit the check_related('webhook_credential', Credential, ..., role_field='use_role') call that UnifiedCredentialsMixin.can_attach performs for the normal many-to-many credentials relationship, and the serializer validates only the credential's type and namespace. A user who may administer their own job template (or workflow job template) and use its project and inventory can therefore attach a webhook token credential (for example a GitLab token) that they do not have use permission on. The template administrator can retrieve the template's webhook key; a subsequent webhook event causes AWX to decrypt the attached token and send it in the request header (for GitLab, PRIVATE-TOKEN) to a status URL derived from the event payload, disclosing the victim's token to a destination the attacker can influence. This may disclose another user's personal access token and allow whatever actions that token permits.
Quoted source text, attributed separately from HOL analysis.