CVE-2026-71363

CVSS 5.3 (medium) · published 2026-11-12

A flaw was found in AWX. The debug API endpoints (/api/debug/task_manager/, /api/debug/dependency_manager/, /api/debug/workflow_manager/) are registered unconditionally in the URL configuration and use AllowAny permission class with _ignore_model_permissions=True. This allows an unauthenticated remote attacker to repeatedly invoke scheduler operations that acquire database advisory locks and open transactions, potentially leading to resource exhaustion and degraded service availability.

Weakness: CWE-306

Source: NVD CVE-2026-71363

References

• https://access.redhat.com/security/cve/CVE-2026-71363
• https://bugzilla.redhat.com/show_bug.cgi?id=2511899

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.