Medium · CVSS 4.3CVE-2026-71367

Awx: websocket broadcast groups leak cross-organization job metadataCVE-2026-71367

Answer in brief

CVE-2026-71367 records a Medium severity (CVSS 4.3) vulnerability in Awx: websocket broadcast groups leak cross-organization job metadata. The current sources do not mark it as known exploited. The current feed maps Red Hat/ansible-automation-platform-26/controller-rhel9 (generic), Red Hat/ansible-automation-platform-27/controller-rhel9 (generic), Red Hat/automation-controller (generic). Check affected ranges and fixed versions before updating.

Analysis pending evidence review

HOL Guard separates source facts from reviewed analysis. See the methodology.

Published Nov 12, 2026Updated Nov 12, 2026Source checked Nov 12, 2026First seen by HOL Nov 12, 2026Material review Nov 12, 2026

Upstream Advisory

Key facts

Risk: Medium · CVSS 4.3
Exploitation: Not marked as known exploited
Affected software: 3 mapped packages or products
Fix availability: Not reported

Why this deserves its current priority

CVSS is 4.3. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps Red Hat/ansible-automation-platform-26/controller-rhel9 (generic), Red Hat/ansible-automation-platform-27/controller-rhel9 (generic), Red Hat/automation-controller (generic). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
Red Hat/ansible-automation-platform-26/controller-rhel9generic	*	Not reported
Red Hat/ansible-automation-platform-27/controller-rhel9generic	*	Not reported
Red Hat/automation-controllergeneric	*	Not reported

Recommended response

Check inventory. Check lockfiles and deployed manifests for Red Hat/ansible-automation-platform-26/controller-rhel9, Red Hat/ansible-automation-platform-27/controller-rhel9, Red Hat/automation-controller.
Review the reported fix. Source-reported workaround: There is no complete mitigation for this vulnerability other than applying the update when available. However, the following measures reduce exposure: 1. In multi-organization deployments, restrict user account creation to necessary personnel and audit user organization memberships. 2. If a reverse proxy or load balancer is in front of the Controller, consider restricting WebSocket upgrade requests (/websocket/) to authenticated sessions with known legitimate use cases. 3. For managed service deployments, engage the managed services team to assess whether additional network-level WebSocket filtering can be applied at the service mesh layer. 4. Monitor WebSocket subscription activity for users subscribing to broadcast groups outside their organization scope.

Evidence timeline and material changes

Published upstream
Nov 12, 2026
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Nov 12, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Nov 12, 2026

Sources and claim methodology

Upstream source description

An incorrect authorization vulnerability was found in AWX's WebSocket consumer. The consumer_access() function only enforces access controls for object-level event groups (job_events, workflow_events, ad_hoc_command_events) but does not restrict subscriptions to global broadcast groups such as 'jobs-status_changed'. When an authenticated user subscribes to a global broadcast group, the server accepts the subscription without verifying that the user has permission to view the associated resources. In multi-organization deployments, this allows a low-privilege user in one organization to receive real-time job status metadata from all organizations, including job IDs, status transitions, timestamps, and infrastructure topology details such as instance group names, bypassing the organization isolation enforced by the REST API.

Quoted source text, attributed separately from HOL analysis.

Affected scope and exposure questions

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
Red Hat/ansible-automation-platform-26/controller-rhel9generic	*	Not reported
Red Hat/ansible-automation-platform-27/controller-rhel9generic	*	Not reported
Red Hat/automation-controllergeneric	*	Not reported

Recommended response

Check inventory. Check lockfiles and deployed manifests for Red Hat/ansible-automation-platform-26/controller-rhel9, Red Hat/ansible-automation-platform-27/controller-rhel9, Red Hat/automation-controller.

Review the reported fix. Source-reported workaround: There is no complete mitigation for this vulnerability other than applying the update when available. However, the following measures reduce exposure: 1. In multi-organization deployments, restrict user account creation to necessary personnel and audit user organization memberships. 2. If a reverse proxy or load balancer is in front of the Controller, consider restricting WebSocket upgrade requests (/websocket/) to authenticated sessions with known legitimate use cases. 3. For managed service deployments, engage the managed services team to assess whether additional network-level WebSocket filtering can be applied at the service mesh layer. 4. Monitor WebSocket subscription activity for users subscribing to broadcast groups outside their organization scope.

Sources and claim methodology

Upstream source description

Quoted source text, attributed separately from HOL analysis.