CVE-2026-16544 Red Hat CVE debrief

Who should care

Users of AWX, especially those with multiple organizations and users with varying levels of access, should be aware of this vulnerability. Authenticated users with access to the AWX system may be able to view real-time stdout output from jobs they do not have access to. Operators, platform administrators, vulnerability managers, and security teams should review the impact and implement necessary mitigations.

Technical summary

The AWX websocket event consumer does not perform RBAC authorization checks for certain event groups (inventory_update_events, project_update_events, and system_job_events). This allows any authenticated user to subscribe to these event groups for any object ID and receive real-time stdout output from jobs belonging to organizations they have no access to. The issue affects users with multiple organizations and varying levels of access. This is an incomplete remediation of CVE-2020-10698.

Defensive priority

Medium

Recommended defensive actions

• Review and update AWX configurations to ensure proper authorization checks are in place for all event groups.
• Limit access to sensitive event groups and object IDs.
• Monitor for suspicious activity and implement additional logging and auditing measures.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record was published on 2026-07-22T12:17:10.480Z and was last modified on 2026-07-22T18:16:59.987Z. The NVD entry is currently Awaiting Analysis. Evidence is limited, and defenders should verify the scope and severity with the vendor. The websocket event consumer performs RBAC authorization checks only for event groups that are mapped in the consumer_access() function (job_events, workflow_events, ad_hoc_command_events). Three event groups - inventory_update_events, project_update_events, and system_job_events — are not mapped, causing the authorization check to be skipped.

Official resources