Description

A flaw was found in Ansible Automation Platform's automation-controller (AWX). The Bulk Job Launch API (POST /api/v2/bulk/job_launch/) authorizes the requested instance_groups with only a read-level permission check, whereas the standard single-job launch path requires use-level permission on the same field. A principal that holds read (but not use) permission on an instance group -- for example the built-in read-only System Auditor role -- together with execute permission on a job template can launch bulk jobs onto instance groups they are not authorized to use, bypassing execution-placement isolation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-09-01T21:18:48.503Z",
  "pubdate": "2026-09-01T21:18:48.503Z",
  "executiveSummary": "A critical authorization flaw exists within the Ansible Automation Platform automation-controller (AWX), specifically located in the bulk job launch API endpoint.\nThe vulnerability involves an Improper Authorization (CWE-285) defect where the system performs insufficient permission checks when validating instance group access during bulk operations.\nThis flaw allows a low-privileged user, such as an authenticated System Auditor, to circumvent execution-placement isolation mechanisms.\nAn attacker possessing 'read' access to an instance group and 'execute' permissions on a job template can initiate jobs on unauthorized infrastructure that would otherwise require 'use' level permissions.\nThis bypasses security boundaries designed to segment automation execution workloads across specific hardware or cloud resources.\nThe risk implication includes potential data exposure, resource exhaustion, or the unauthorized execution of sensitive jobs on restricted infrastructure segments.\nSuccessful exploitation requires authenticated access to the platform and specific pre-existing, albeit limited, role assignments within the application.",
  "technicalDetails": "The root cause of this vulnerability is an inconsistent implementation of the Role-Based Access Control (RBAC) validation logic within the bulk job launch workflow. Specifically, the API endpoint 'POST /api/v2/bulk/job_launch/' fails to enforce the 'use' permission requirement on the 'instance_groups' field, which is strictly enforced in the standard single-job launch code path.\nIn the standard execution flow, the automation-controller validates that a user possesses 'use' level permission for any assigned instance group before scheduling a job. This ensures that users cannot deploy workloads onto infrastructure segments they are not explicitly authorized to utilize. However, the bulk launch implementation incorrectly defaults to a 'read' permission check, effectively lowering the security threshold for authorized interaction with instance groups.\nThe attack flow proceeds as follows: An attacker authenticated with 'read-only' privileges (e.g., the System Auditor role) identifies a job template for which they have 'execute' permissions. The attacker then crafts a malicious request to the '/api/v2/bulk/job_launch/' endpoint. Within the request body, the attacker specifies an instance group that they have read access to but lack explicit 'use' permissions for. Because the application logic fails to perform the mandatory 'use' check, the controller accepts the payload, bypasses the intended placement policy, and schedules the job onto the restricted instance group.\nThe vulnerable component is the automation-controller, specifically the logic handling bulk payload parsing and resource validation. This vulnerability directly undermines the integrity of execution-placement isolation policies, allowing lateral movement of tasks into restricted execution environments. Because the API validates access based on the less restrictive 'read' capability, the application erroneously assumes the caller has sufficient authority to leverage the resource for actual job execution.\nImpact includes the ability to influence workload distribution across restricted nodes, potentially bypassing compliance requirements or organizational segmentation policies. There are no requirements for external network exposure, as the flaw resides entirely within the application-level authorization service, requiring only a valid session with appropriate (though restricted) application roles."
}