CVE-2026-16544

Medium [CVE-2020-10698 +1] websocket EventConsumer missing authorization for inventory_update_events, project_update_events, and system_job_events allows cross-organization stdout disclosure

CVE-2026-16544Source published Jul 22, 2026Source updated Jul 22, 2026

This bulletin covers 2 CVEs. The products, versions, score and guidance below describe the bulletin; check its source for applicability to this specific CVE.

A flaw was found in AWX. The websocket event consumer performs RBAC authorization checks only for event groups that are mapped in the consumer_access() function (job_events, workflow_events, ad_hoc_command_events). Three event groups - inventory_update_events, project_update_events, and system_job_events — are not mapped, causing the authorization check to be skipped. Any authenticated user can subscribe to these unmapped websocket event groups for any object ID and receive real-time stdout output from jobs belonging to organizations they have no access to. This is an incomplete remediation of CVE-2020-10698. This flaw affects all versions of Ansible Automation Platform that ship the Controller component (formerly Ansible Tower). Exploitation requires a valid authenticated user account…

Affected products in this advisory

• Red Hat Ansible Automation Platform 2

Source-reported affected versions

Affected-version details not available in this record.

Source-reported fixed versions

No fixed-version detail extracted. This does not mean no fix exists.

Mitigation guidance

• The following practices would help for avoiding exposure and mitigate this flaw: - Restrict AWX/Controller user account creation to only trusted individuals. Since any authenticated user can exploit this flaw regardless of role, minimizing the number of user accounts reduces the attack surface. - Use external authentication (LDAP, SAML, OIDC) with strict group mappings to prevent self-registration and ensure only authorized users can log in. - Review the list of AWX/Controller users and remove or deactivate any accounts that are no longer needed. - Monitor websocket connections and subscriptions for unusual patterns, such as a user subscribing to inventory_update_events or project_update_events for object IDs outside their organization. - Avoid embedding credentials in SCM URLs or inventory source configurations, as these may appear in stdout output. Use credential objects instead. - Apply network segmentation to restrict access to the AWX/Controller web interface to trusted networks only.