CVE-2026-71363

MediumCVSS 5.3/10Last modified Nov 12, 2026

Description

A flaw was found in AWX. The debug API endpoints (/api/debug/task_manager/, /api/debug/dependency_manager/, /api/debug/workflow_manager/) are registered unconditionally in the URL configuration and use AllowAny permission class with _ignore_model_permissions=True. This allows an unauthenticated remote attacker to repeatedly invoke scheduler operations that acquire database advisory locks and open transactions, potentially leading to resource exhaustion and degraded service availability.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-306

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Nov 12, 2026
Last modified: Nov 12, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-713647.2A path traversal vulnerability was found in AWX's project archive extraction. The project_archive action plugin extracts zip and tar archive CVE-2026-713657.7A server-side request forgery (SSRF) vulnerability was found in AWX's webhook status callback mechanism. When processing GitHub pull request CVE-2026-713667.7A server-side request forgery (SSRF) vulnerability was found in multiple AWX notification backends. The webhook, Mattermost, Rocket.Chat, an CVE-2026-713674.3An incorrect authorization vulnerability was found in AWX's WebSocket consumer. The consumer_access() function only enforces access controls CVE-2026-713685.1F-RevoCRM contains a cross-site scripting vulnerability. If a user views a crafted page while logged in to the affected product, unintended CVE-2026-71379.8A security vulnerability has been detected in Totolink A8000RU 7.1cu.643_b20200521. This affects the function setStorageCfg of the file /cgi CVE-2026-713749.8Deserialization of untrusted data vulnerability in Cosminexus Component Container. This issue affects Cosminexus Component Container: from CVE-2026-713757.4Improper restriction of XML external entity reference vulnerability in Cosminexus Component Container. This issue affects Cosminexus Compon CVE-2026-713769.8OS command injection vulnerability in Cosminexus Component Container. This issue affects Cosminexus Component Container: from 11-70-01 befo CVE-2026-713779.8Command Argument Injection Vulnerability in Cosminexus Component Container. This issue affects Cosminexus Component Container: from 11-70-0 CVE-2026-713784.6ResourceIsolationRequestCycleListener protects a Wicket application against cross-site request forgery by rejecting requests that a resource CVE-2026-7137910.0The file export endpoint allows any unauthenticated attacker to export arbitrary database tables by sending a crafted POST request.