CVE-2020-10698
published 2021-05-27CVE-2020-10698: A flaw was found in Ansible Tower when running jobs. This flaw allows an attacker to access the stdout of the executed jobs which are run from other…
PriorityP412low3.3CVSS 3.1
AVLACLPRLUINSUCLINAN
EPSS
0.27%
18.8th percentile
A flaw was found in Ansible Tower when running jobs. This flaw allows an attacker to access the stdout of the executed jobs which are run from other organizations. Some sensible data can be disclosed. However, critical data should not be disclosed, as it should be protected by the no_log flag when debugging is enabled. This flaw affects Ansible Tower versions before 3.6.4, Ansible Tower versions before 3.5.6 and Ansible Tower versions before 3.4.6.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ansible-automation-platform-27 | controller-rhel9 | — | — |
| redhat | ansible_tower | < 3.4.6 | 3.4.6 |
| redhat | ansible_tower | >= 3.5.0 < 3.5.6 | 3.5.6 |
| redhat | ansible_tower | >= 3.6.0 < 3.6.4 | 3.6.4 |
CVSS provenance
nvdv3.13.3LOWCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
nvdv2.02.1LOWAV:L/AC:L/Au:N/C:P/I:N/A:N
vendor_redhat3.3LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
A flaw was found in AWX.
ghsa_unreviewed·2026-07-22·CVSS 3.3
CVE-2026-16544 [LOW] CWE-862 A flaw was found in AWX.
A flaw was found in AWX. The websocket event consumer performs RBAC authorization checks only for event groups that are mapped in the consumer_access() function (job_events, workflow_events, ad_hoc_command_events). Three event groups - inventory_update_events, project_update_events, and system_job_events — are not mapped, causing the authorization check to be skipped. Any authenticated user can subscribe to these unmapped websocket event groups for any object ID and receive real-time stdout output from jobs belonging to organizations they have no access to. This is an incomplete remediation of CVE-2020-10698.
GHSA
GHSA-j574-xrvq-v9wf: A flaw was found in Ansible Tower when running jobs
ghsa_unreviewed·2022-05-24
CVE-2020-10698 [LOW] CWE-200 GHSA-j574-xrvq-v9wf: A flaw was found in Ansible Tower when running jobs
A flaw was found in Ansible Tower when running jobs. This flaw allows an attacker to access the stdout of the executed jobs which are run from other organizations. Some sensible data can be disclosed. However, critical data should not be disclosed, as it should be protected by the no_log flag when debugging is enabled. This flaw affects Ansible Tower versions before 3.6.4, Ansible Tower versions before 3.5.6 and Ansible Tower versions before 3.4.6.
Red Hat
awx: websocket EventConsumer missing authorization for inventory_update_events, project_update_events, and system_job_events allows cross-organization stdout disclosure
vendor_redhat·2026-07-22·CVSS 3.3
CVE-2026-16544 [LOW] CWE-862 awx: websocket EventConsumer missing authorization for inventory_update_events, project_update_events, and system_job_events allows cross-organization stdout disclosure
awx: websocket EventConsumer missing authorization for inventory_update_events, project_update_events, and system_job_events allows cross-organization stdout disclosure
A flaw was found in AWX. The websocket event consumer performs RBAC authorization checks only for event groups that are mapped in the consumer_access() function (job_events, workflow_events, ad_hoc_command_events). Three event groups - inventory_update_events, project_update_events, and system_job_events — are not mapped, causing the authorization check to be skipped. Any authenticated user can subscribe to these unmapped websocket event groups for any object ID and receive real-time stdout output from jobs belonging to organizations they have no access to. This is an incomplete remediation of CVE-2020-10698.
Statement: T
Red Hat
Tower: normal users can intercept stdout from jobs running in other organizations
vendor_redhat·2020-03-27·CVSS 3.3
CVE-2020-10698 [LOW] CWE-200 Tower: normal users can intercept stdout from jobs running in other organizations
Tower: normal users can intercept stdout from jobs running in other organizations
A flaw was found in Ansible Tower when running jobs. This flaw allows an attacker to access the stdout of the executed jobs which are run from other organizations. Some sensible data can be disclosed. However, critical data should not be disclosed, as it should be protected by the no_log flag when debugging is enabled. This flaw affects Ansible Tower versions before 3.6.4, Ansible Tower versions before 3.5.6 and Ansible Tower versions before 3.4.6.
A flaw was found in Ansible Tower when running jobs. This flaw allows an attacker to access the stdout of the executed jobs which are run from other organizations. Some sensible data can be disclosed. However, critical data should not be disclosed, as it should b
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-16544 awx: websocket EventConsumer missing authorization for inventory_update_events, project_update_events, and system_job_events allows cross-organization stdout disclosure
bugzilla·2026-07-22·CVSS 3.3
CVE-2026-16544 [LOW] CVE-2026-16544 awx: websocket EventConsumer missing authorization for inventory_update_events, project_update_events, and system_job_events allows cross-organization stdout disclosure
CVE-2026-16544 awx: websocket EventConsumer missing authorization for inventory_update_events, project_update_events, and system_job_events allows cross-organization stdout disclosure
A flaw was found in the AWX websocket event consumer. The consumer_access() function in awx/main/access.py maps RBAC access classes for only three event groups (job_events, workflow_events, ad_hoc_command_events). When EventConsumer.receive_json() in awx/main/consumers.py processes a subscription request for the three unmapped groups (inventory_update_events, project_update_events, system_job_events), consumer_access() returns None, causing the RBAC authorization check to be skipped entirely. The user is unconditionally subscribed to the channel. As a result, any authenticated user - regardless of role or or
Bugzilla
CVE-2020-10698 Tower: normal users can intercept stdout from jobs running in other organizations
bugzilla·2020-03-30·CVSS 3.3
CVE-2020-10698 [LOW] CVE-2020-10698 Tower: normal users can intercept stdout from jobs running in other organizations
CVE-2020-10698 Tower: normal users can intercept stdout from jobs running in other organizations
Ansible Tower should prevent ws group subscription if not specified in the valid format. Otherwise this would allow normal users intercept stdout from jobs running in other organizations.
Discussion:
Acknowledgments:
Name: Ryan Petrello (Red Hat)
---
Statement:
Ansible Tower 3.4.5, 3.5.5 and 3.6.3 as well as previous versions are affected.
---
Mitigation:
This issue is possible to mitigate by disabling the stdout from jobs run through the nginx configuration file. However this may affect the usage of Tower as stdout stream would be hidden. To disable the output of running jobs the entire 'location /websocket' block from the nginx configuration (and restarting nginx service) it would b
2021-05-27
Published