REDHAT-BUG-2490796: Medium severity Ansible AWX vulnerability
A flaw was found in the AWX GitHub webhook integration. When a GitHub pullrequest webhook is received, GithubWebhookReceiver.geteventstatusapi() in awx/api/views/webhooks.py returns pullrequest.statusesurl from the request body without validation. The value is stored in job extra variables as awxwebhookstatusapi and later used by WebhookMixin.updatewebhookstatus() in awx/main/models/mixins.py as the callback URL when posting job status updates. If a job template is configured with webhookservice=github and a GitHub Personal Access Token credential as webhookcredential, the controller sends that token in the Authorization header when POSTing to the stored callback URL on job completion. Although the controller is designed to post commit status updates back to GitHub, it does not restrict the callback URL to trusted GitHub API endpoints. An attacker who can submit a forged webhook request with a valid HMAC-SHA1 signature for the target job template's webhookkey can supply an attacker-controlled statusesurl and cause exfiltration of the configured GitHub PAT when the triggered job completes. Normal GitHub webhook deliveries do not allow arbitrary contributors to control statusesurl; exploitation requires knowledge of the per-template webhook shared secret or privileged access to retrieve it from the controller. Upstream: https://github.com/ansible/awx Affected files: - awx/api/views/webhooks.py (GithubWebhookReceiver.geteventstatusapi) - awx/main/models/mixins.py (WebhookMixin.updatewebhookstatus)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Validate the pull_request.statuses_url received in incoming GitHub webhooks and reject or override values that are not GitHub-owned API endpoints before storing or using them as callback URLs for status updates.
AWX (GitHub webhook integration) statuses_url validation = only allow trusted GitHub API endpoints - Configuration
Do not configure webhook_credential for job templates with a GitHub Personal Access Token. Remove existing PATs from webhook_credential and use a less-privileged mechanism or credential that does not expose a PAT to webhook-driven callbacks.
AWX job template webhook credential webhook_credential = do not use a GitHub Personal Access Token (PAT) - Compensating control
Restrict network egress from AWX controllers so callback POSTs for job status may only reach trusted GitHub API endpoints (allowlist GitHub API domains/IPs). Block outbound HTTP(S) requests to arbitrary external URLs from the controller to prevent exfiltration to attacker-controlled statuses_url values.
- Operational
Audit all job templates for webhook_service=github and identify any that use a GitHub Personal Access Token as webhook_credential. Reconfigure affected templates to remove or replace the credential and review recent job runs for potential token leakage.
- Operational
If compromise is suspected or as a precaution, rotate/revoke any GitHub Personal Access Tokens used as webhook_credential and rotate per-template webhook shared secrets (webhook_key) to prevent replay or forged webhook exploitation.
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2490796?
The severity of REDHAT-BUG-2490796 is medium, rated at 4.
What software is affected by REDHAT-BUG-2490796?
Ansible AWX is the affected software for REDHAT-BUG-2490796.
What is the flaw described in REDHAT-BUG-2490796?
REDHAT-BUG-2490796 describes a flaw where the AWX GitHub webhook integration does not validate the 'statuses_url' from the pull request, leading to potential information leakage.
How do I fix REDHAT-BUG-2490796?
To fix REDHAT-BUG-2490796, ensure that the 'statuses_url' value from the GitHub webhook is validated before being processed by the AWX application.
When was REDHAT-BUG-2490796 published?
REDHAT-BUG-2490796 was published on June 19, 2026.