For GitHub pull_request webhooks, get_event_status_api() in awx/api/views/webhooks.py returns pull_request.statuses_url from the request body verbatim without any host validation:

def get_event_status_api(self):
    if self.get_event_type() != 'pull_request':
        return
    return self.request.data.get('pull_request', {}).get('statuses_url')

The value is persisted into job extra_vars and later used by update_webhook_status() in awx/main/models/mixins.py:

status_api = self.extra_vars_dict.get('awx_webhook_status_api')
headers = {k: v.format(self.webhook_credential.get_input('token')), 'Content-Type': 'application/json'}
response = requests.post(status_api, data=json.dumps(data), headers=headers, timeout=30)

There is no host allowlist for the expected Git provider endpoint and no private-network egress filtering before the request is sent. The webhook receiver relies on an HMAC secret (webhook_key), which is readable by users with the admin role on the job template via /api/v2/job_templates/{id}/webhook_key/. This allows a template admin to forge a signed webhook payload with statuses_url pointing to an attacker-controlled endpoint, and AWX will POST status updates including the Git PAT in the Authorization header to that endpoint.