{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-16544", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2026-07-22T09:58:35.294Z", "datePublished": "2026-07-22T11:15:53.882Z", "dateUpdated": "2026-07-22T11:15:53.882Z"}, "containers": {"cna": {"title": "Awx: websocket eventconsumer missing authorization for inventory_update_events, project_update_events, and system_job_events allows cross-organization stdout disclosure", "metrics": [{"other": {"content": {"value": "Moderate", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "A flaw was found in AWX. The websocket event consumer performs RBAC authorization checks only for event groups that are mapped in the consumer_access() function (job_events, workflow_events, ad_hoc_command_events). Three event groups - inventory_update_events, project_update_events, and system_job_events \u2014 are not mapped, causing the authorization check to be skipped. Any authenticated user can subscribe to these unmapped websocket event groups for any object ID and receive real-time stdout output from jobs belonging to organizations they have no access to. This is an incomplete remediation of CVE-2020-10698."}], "affected": [{"vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-automation-platform-27/controller-rhel9", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:ansible_automation_platform:2"]}, {"vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "automation-controller", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:ansible_automation_platform:2"]}], "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-16544", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2506053", "name": "RHBZ#2506053", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "datePublic": "2026-07-22T00:00:00.000Z", "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "description": "Missing Authorization", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-862: Missing Authorization", "workarounds": [{"lang": "en", "value": "The following practices would help for avoiding exposure and mitigate this flaw:\n\n- Restrict AWX/Controller user account creation to only trusted individuals. Since any authenticated user can exploit this flaw regardless of role, minimizing the number of user accounts reduces the attack surface.\n- Use external authentication (LDAP, SAML, OIDC) with strict group mappings to prevent self-registration and ensure only authorized users can log in.\n- Review the list of AWX/Controller users and remove or deactivate any accounts that are no longer needed.\n- Monitor websocket connections and subscriptions for unusual patterns, such as a user subscribing to inventory_update_events or project_update_events for object IDs outside their organization.\n- Avoid embedding credentials in SCM URLs or inventory source configurations, as these may appear in stdout output. Use credential objects instead.\n- Apply network segmentation to restrict access to the AWX/Controller web interface to trusted networks only."}], "timeline": [{"lang": "en", "time": "2026-07-22T09:56:58.086Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-07-22T00:00:00.000Z", "value": "Made public."}], "credits": [{"lang": "en", "value": "Red Hat would like to thank Ta Duc Thien (Ninh Thanh Security team (NTCS)) for reporting this issue."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-07-22T11:15:53.882Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}}}

{}

{}

{"acknowledgement": "Red Hat would like to thank Ta Duc Thien (Ninh Thanh Security team (NTCS)) for reporting this issue.", "bugzilla": {"description": "awx: websocket EventConsumer missing authorization for inventory_update_events, project_update_events, and system_job_events allows cross-organization stdout disclosure", "id": "2506053", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2506053"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "status": "draft"}, "cwe": "CWE-862", "details": ["A flaw was found in AWX. The websocket event consumer performs RBAC authorization checks only for event groups that are mapped in the consumer_access() function (job_events, workflow_events, ad_hoc_command_events). Three event groups - inventory_update_events, project_update_events, and system_job_events \u2014 are not mapped, causing the authorization check to be skipped. Any authenticated user can subscribe to these unmapped websocket event groups for any object ID and receive real-time stdout output from jobs belonging to organizations they have no access to. This is an incomplete remediation of CVE-2020-10698."], "mitigation": {"lang": "en:us", "value": "The following practices would help for avoiding exposure and mitigate this flaw:\n- Restrict AWX/Controller user account creation to only trusted individuals. Since any authenticated user can exploit this flaw regardless of role, minimizing the number of user accounts reduces the attack surface.\n- Use external authentication (LDAP, SAML, OIDC) with strict group mappings to prevent self-registration and ensure only authorized users can log in.\n- Review the list of AWX/Controller users and remove or deactivate any accounts that are no longer needed.\n- Monitor websocket connections and subscriptions for unusual patterns, such as a user subscribing to inventory_update_events or project_update_events for object IDs outside their organization.\n- Avoid embedding credentials in SCM URLs or inventory source configurations, as these may appear in stdout output. Use credential objects instead.\n- Apply network segmentation to restrict access to the AWX/Controller web interface to trusted networks only."}, "name": "CVE-2026-16544", "package_state": [{"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Fix deferred", "package_name": "ansible-automation-platform-27/controller-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Fix deferred", "package_name": "automation-controller", "product_name": "Red Hat Ansible Automation Platform 2"}], "public_date": "2026-07-22T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-16544\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-16544"], "statement": "This flaw affects all versions of Ansible Automation Platform that ship the Controller component (formerly Ansible Tower). The websocket RBAC mechanism was introduced as part of the fix for CVE-2020-10698, but the consumer_access() function was never updated to cover all subscribable event groups. Exploitation requires a valid authenticated user account on the AWX/Controller instance, but no specific role or organization membership is needed. The attacker receives stdout and event metadata in real time for inventory updates, project updates, and system jobs across all organizations. In multi-tenant deployments (including managed services), this allows one tenant's users to observe another tenant's job output.", "threat_severity": "Moderate"}

{}