CVE-2026-16544: AWX WS RBAC Skip Exposes Job Output to Unauthorized Users
CVE-2026-16544 Published on July 22, 2026

Awx: websocket eventconsumer missing authorization for inventory_update_events, project_update_events, and system_job_events allows cross-organization stdout disclosure
A flaw was found in AWX. The websocket event consumer performs RBAC authorization checks only for event groups that are mapped in the consumer_access() function (job_events, workflow_events, ad_hoc_command_events). Three event groups - inventory_update_events, project_update_events, and system_job_events are not mapped, causing the authorization check to be skipped. Any authenticated user can subscribe to these unmapped websocket event groups for any object ID and receive real-time stdout output from jobs belonging to organizations they have no access to. This is an incomplete remediation of CVE-2020-10698.

NVD

Vulnerability Analysis

CVE-2026-16544 is exploitable with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity and availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
LOW
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
NONE
Availability Impact:
NONE

Timeline

Reported to Red Hat.

Made public.

Weakness Type

What is an AuthZ Vulnerability?

The software does not perform an authorization check when an actor attempts to access a resource or perform an action.

CVE-2026-16544 has been classified to as an AuthZ vulnerability or weakness.


Products Associated with CVE-2026-16544

Want to know whenever a new CVE is published for Red Hat Ansible Automation Platform? stack.watch will email you.

Red Hat Ansible Automation Platform
 

Affected Versions

Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: