A flaw was found in automation-controller (AWX). The external credential test
endpoints execute the credential plugin backend in-process in the controller web
service (awx/api/views/__init__.py CredentialExternalTest /
CredentialTypeExternalTest -> _call_backend_with_error_handling ->
plugin.backend()). CredentialExternalTest uses obj_permission_type='use' and
merges request-body 'inputs' over the stored credential inputs, so a user with
only the use role can override server_url. The Thycotic Secret Server plugin
(awx-plugins src/awx_plugins/credentials/tss.py tss_backend) passes server_url
verbatim into the delinea/thycotic SDK, which issues GET {server_url}/api/v1/
healthcheck and GET {server_url}/health and, on a healthy response, POST
{server_url}/oauth2/token, with no allow-list, scheme, IP-range, or DNS-rebind
check. Errors are wrapped as a bare SecretServerError (blind), but latency
differs by target state (refused ~0.5s vs filtered ~12s until the gateway 503s),
yielding a reliable timing oracle for scanning in-cluster services, the
Kubernetes API, link-local metadata (169.254.169.254), and localhost daemons
from the control-plane pod. This is the same root-cause class as the previously
reported HashiCorp Vault / Centrify / CyberArk CCP credential-plugin SSRFs;
Thycotic Secret Server is an additional sink. Discovered internally; verified
live on AAP 2.6/2.7 / automation-controller 4.8.1; still present on devel (both
awx and awx-plugins).
    Upstream: github.com/ansible/awx (awx/api/views/__init__.py
              CredentialExternalTest, CredentialTypeExternalTest,
              _call_backend_with_error_handling); github.com/ansible/awx-plugins
              (src/awx_plugins/credentials/tss.py tss_backend)