CVE-2026-76648 is a vulnerability in Red Hat Ansible Automation Platform
Published on September 23, 2026
Automation-controller: automation-controller-container: aap controller: copyapiview.post() missing read authorization check enables job template secret recovery
CopyAPIView (awx/awx/api/generics.py:873) sets permission_classes =
(IsAuthenticated,), so DRF's get_object() performs no object-level
RBAC. The get() handler (lines 988991) explicitly guards with
request.user.can_access(obj._class_, 'read', obj) but post()
(lines 10011010) does not. POST only checks:
can_access(model, 'add', create_kwargs_check)
can_access(model, 'copy_related', obj)
For JobTemplate, can_add (awx/awx/main/access.py:14651520) gates on
inventory.use_role + project.use_role +
execution_environment.read_role resource-level roles that do not
imply read on the source JT and can_copy_related (15221534) checks
only credentials.use_role. None of these imply the caller can read the
source JT.
Vulnerability Analysis
CVE-2026-76648 is exploitable with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity, and no impact on availability.
Timeline
Reported to Red Hat.
Made public. 18 days later.
Weakness Type
What is an AuthZ Vulnerability?
The software does not perform an authorization check when an actor attempts to access a resource or perform an action.
CVE-2026-76648 has been classified to as an AuthZ vulnerability or weakness.
Products Associated with CVE-2026-76648
Want to know whenever a new CVE is published for Red Hat Ansible Automation Platform? stack.watch will email you.