Bug 2506053 (CVE-2026-16544)

Summary: CVE-2026-16544 awx: websocket EventConsumer missing authorization for inventory_update_events, project_update_events, and system_job_events allows cross-organization stdout disclosure
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: dschmidt, jlanda, kshier, simaishi, stcannon, teagle, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in AWX. The websocket event consumer performs RBAC authorization checks only for event groups that are mapped in the consumer_access() function (job_events, workflow_events, ad_hoc_command_events). Three event groups - inventory_update_events, project_update_events, and system_job_events — are not mapped, causing the authorization check to be skipped. Any authenticated user can subscribe to these unmapped websocket event groups for any object ID and receive real-time stdout output from jobs belonging to organizations they have no access to. This is an incomplete remediation of CVE-2020-10698.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-07-22 10:04:06 UTC 
A flaw was found in the AWX websocket event consumer. The consumer_access() function in awx/main/access.py maps RBAC access classes for only three event groups (job_events, workflow_events, ad_hoc_command_events). When EventConsumer.receive_json() in awx/main/consumers.py processes a subscription request for the three unmapped groups (inventory_update_events, project_update_events, system_job_events), consumer_access() returns None, causing the RBAC authorization check to be skipped entirely. The user is unconditionally subscribed to the channel. As a result, any authenticated user - regardless of role or organization membership - can subscribe to these websocket groups for any object ID and receive real-time stdout output and event_data from inventory syncs, project updates, and system jobs belonging to other organizations. This is an incomplete remediation of CVE-2020-10698, which established the RBAC mechanism but only mapped three of the six subscribable event groups. Object IDs are globally sequential UnifiedJob IDs and are trivially enumerable. Stdout data on the websocket path is not redacted (redaction exists only in REST serializers), and project update stdout may contain SCM basic-auth credentials. Verified on AWX 24.6.1; same code path confirmed on devel branch.