https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 19 Oct 2026 01:42:42 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-329007 EUVD-2026-329007 https://cve.radiocsirt.org/vuln/euvd-2026-329007 https://cve.radiocsirt.org/vuln/fkie_cve-2026-12726 <p>A flaw was found in the AWX GitHub webhook integration. When processing GitHub pull_request webhooks, the controller stores the pull_request.statuses_url value from the webhook payload without validating that it points to a trusted GitHub API endpoint. If a job template is configured with a GitHub Personal Access Token as its webhook credential, the controller later POSTs that token to the stored callback URL when posting job status updates. An attacker who can submit a correctly signed forged webhook using the job template&#39;s webhook_key can redirect the callback to an attacker-controlled URL and exfiltrate the configured GitHub PAT.</p> <p>A flaw was found in the AWX GitHub webhook integration. When processing GitHub pull_request webhooks, the controller stores the pull_request.statuses_url value from the webhook payload without validating that it points to a trusted GitHub API endpoint. If a job template is configured with a GitHub Personal Access Token as its webhook credential, the controller later POSTs that token to the stored callback URL when posting job status updates. An attacker who can submit a correctly signed forged webhook using the job template&#39;s webhook_key can redirect the callback to an attacker-controlled URL and exfiltrate the configured GitHub PAT.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-12726 https://cve.radiocsirt.org/vuln/ghsa-w8qh-qh69-53cx <p>A flaw was found in the AWX GitHub webhook integration. When processing GitHub pull_request webhooks, the controller stores the pull_request.statuses_url value from the webhook payload without validating that it points to a trusted GitHub API endpoint. If a job template is configured with a GitHub Personal Access Token as its webhook credential, the controller later POSTs that token to the stored callback URL when posting job status updates. An attacker who can submit a correctly signed forged webhook using the job template&#39;s webhook_key can redirect the callback to an attacker-controlled URL and exfiltrate the configured GitHub PAT.</p> <p>A flaw was found in the AWX GitHub webhook integration. When processing GitHub pull_request webhooks, the controller stores the pull_request.statuses_url value from the webhook payload without validating that it points to a trusted GitHub API endpoint. If a job template is configured with a GitHub Personal Access Token as its webhook credential, the controller later POSTs that token to the stored callback URL when posting job status updates. An attacker who can submit a correctly signed forged webhook using the job template&#39;s webhook_key can redirect the callback to an attacker-controlled URL and exfiltrate the configured GitHub PAT.</p> https://cve.radiocsirt.org/vuln/ghsa-w8qh-qh69-53cx