PT-2026-145889
CVE-2026-71363
·
تاريخ النشر
2026-11-12
·
تاريخ التحديث
2026-11-12
الوصف من
CVSS 3.1
5.3
متوسطةالمقاييسAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
A flaw was found in AWX. The debug API endpoints (/api/debug/task manager/, /api/debug/dependency manager/, /api/debug/workflow manager/) are registered unconditionally in the URL configuration and use AllowAny permission class with ignore model permissions=True. This allows an unauthenticated remote attacker to repeatedly invoke scheduler operations that acquire database advisory locks and open transactions, potentially leading to resource exhaustion and degraded service availability.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾