{"id":"EM-20261112-N7PQ","url":"https://cyber.eventmonitor.net/incident/EM-20261112-N7PQ/awx-vulnerability-cve-2026-126642/","type":"cve","title":"AWX Vulnerability (CVE-2026-126642)","subtitle":"CVE-2026-126642","subject":"CVE-2026-126642","status":"Developing","severity":"medium","affected":[],"headline":null,"born":"2026-11-12T09:32:51.000Z","firstSignal":"2026-11-11T14:23:35.000Z","lastSignal":"2026-11-12T09:32:51.000Z","updated":"2026-11-12T12:09:51.346Z","revision":1,"life":[{"status":"Born","at":"2026-11-12T09:32:51.000Z","why":"second independent source: C29 CIRCL Vulnerability-Lookup"},{"status":"Developing","at":"2026-11-12T09:32:51.000Z","why":"signals keep joining"}],"changeLog":[{"at":"2026-11-11T14:23:35.000Z","what":"First signal: C41 Red Hat Security Data"},{"at":"2026-11-12T09:32:51.000Z","what":"Born: second source, C29 CIRCL Vulnerability-Lookup. Page EM-20261112-N7PQ created."}],"stages":[{"name":"Disclosed","at":"2026-11-12T09:16:40.020Z","detail":"C6 NVD published"},{"name":"Scored","at":"2026-11-12T09:16:40.020Z","detail":"CVSS 6.5"},{"name":"Exploited","at":null,"detail":"No exploitation reported"},{"name":"Advisories","at":null,"detail":"None yet"},{"name":"Vendor Response","at":"2026-11-11T14:23:35.000Z","detail":"C41 published"},{"name":"Resolved","at":null,"detail":"After 14 quiet days"}],"signals":[{"at":"2026-11-11T14:23:35.000Z","source":"C41","sourceName":"Red Hat Security Data","role":"Vendor","severity":2,"title":"Red Hat: CVE-2026-126642 (moderate)","text":"awx: webhook credential assignment omits use_role check, exposing another user's token","url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-126642.json"},{"at":"2026-11-12T09:32:51.000Z","source":"C29","sourceName":"CIRCL Vulnerability-Lookup","role":"Database","severity":2,"title":"GHSA-c92q-w8v5-r4hp / CVE-2026-126642","text":"An incorrect authorization flaw was found in AWX, the automation controller component of Red Hat Ansible Automation Platform. The API access classes for JobTemplate and WorkflowJobTemplate do not check the caller's Credential use_role when assigning the single-valued webhook_credential foreign…","url":"https://vulnerability.circl.lu/vuln/GHSA-c92q-w8v5-r4hp"}],"crowd":[],"reference":{"nvd":{"published":"2026-11-12T09:16:40.020","score":6.5,"severity":"MEDIUM","desc":"An incorrect authorization flaw was found in AWX, the automation controller component of Red Hat Ansible Automation Platform. The API access classes for JobTemplate and WorkflowJobTemplate do not check the caller's Credential use_role when assigning the single-valued webhook_credential foreign…","product":"","seen":1794485391346},"kev":null,"epss":null,"p0":false},"mergedInto":null,"publisher":"Event Monitor Cyber"}