CVE-2026-71363

A flaw was found in AWX. The debug API endpoints (/api/debug/task manager/, /api/debug/dependency manager/, /api/debug/workflow manager/) are registered unconditionally in the URL configuration and use AllowAny permission class with ignore model permissions=True. This allows an unauthenticated remote attacker to repeatedly invoke scheduler operations that acquire database advisory locks and open transactions, potentially leading to resource exhaustion and degraded service availability.