Several AWX notification backends send HTTP requests to notification template URLs without private-network egress filtering. The affected backends are:

- Webhook backend (awx/main/notifications/webhook_backend.py): POSTs to configured URL with Basic Auth. Follows redirects manually and reuses the same Basic Auth tuple for each redirected request regardless of host change.
- Mattermost backend (awx/main/notifications/mattermost_backend.py): POSTs to configured URL without egress filtering.
- Rocket.Chat backend (awx/main/notifications/rocketchat_backend.py): POSTs to configured URL without egress filtering.
- Grafana backend (awx/main/notifications/grafana_backend.py): Sends API key in Authorization: Bearer header to {grafana_url}/api/annotations.

The webhook backend code path:

url = str(m.recipients()[0])
resp = chosen_method(url=url, auth=auth, ...)
url_next = resp.headers.get('Location', None)
url = url_next  # No host validation before resending auth

The Grafana backend:

grafana_headers['Authorization'] = 'Bearer {}'.format(self.grafana_key)
requests.post('{}/api/annotations'.format(m.recipients()[0]), ...)

There is no private, loopback, link-local, or reserved-address egress check in the notification send path, and redirect targets are not revalidated before credentials are reused.