A flaw was found in the AWX GitHub webhook integration. When a GitHub pull_request webhook is received, GithubWebhookReceiver.get_event_status_api() in awx/api/views/webhooks.py returns pull_request.statuses_url from the request body without validation. The value is stored in job extra variables as awx_webhook_status_api and later used by WebhookMixin.update_webhook_status() in awx/main/models/mixins.py as the callback URL when posting job status updates.
If a job template is configured with webhook_service=github and a GitHub Personal Access Token credential as webhook_credential, the controller sends that token in the Authorization header when POSTing to the stored callback URL on job completion. Although the controller is designed to post commit status updates back to GitHub, it does not restrict the callback URL to trusted GitHub API endpoints.
An attacker who can submit a forged webhook request with a valid HMAC-SHA1 signature for the target job template's webhook_key can supply an attacker-controlled statuses_url and cause exfiltration of the configured GitHub PAT when the triggered job completes. Normal GitHub webhook deliveries do not allow arbitrary contributors to control statuses_url; exploitation requires knowledge of the per-template webhook shared secret or privileged access to retrieve it from the controller.
Upstream: https://github.com/ansible/awx
Affected files:
  - awx/api/views/webhooks.py (GithubWebhookReceiver.get_event_status_api)
  - awx/main/models/mixins.py (WebhookMixin.update_webhook_status)