Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

ansible/awx

              devel @ f8fa690
            

409

Fixes

CVEs

CRITICAL

Peak severity

Highlights

Auth Bypass: 263 prior fixes. Scrutinize any change in this area.

awx/main/access.py: most-fixed (102 issues). Treat as high-risk during review.

180 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: The custom Role-Based Access Control (RBAC) engine in AWX has historically suffered from extensive authorization bypasses, frequently failing to enforce multi-tenant organization boundaries during user, team, or credential assignments. Developers must use unified access helpers (like has_obj_perm) and explicitly filter querysets by the user's validated roles.

Code Execution: Untrusted user input injected into credential type configuration templates and survey variables could bypass validation, leading to arbitrary Python code execution or sandbox escapes via standard Jinja2 environments. Secure sandboxed rendering is required.

Privilege Escalation: Kubernetes job pods could mount default service account tokens by default, allowing container groups to escape boundaries and access the cluster API. This requires explicitly disabling automountServiceAccountToken and validating that configurations cannot override it.