CVE-2026-16544

A flaw was found in AWX. The websocket event consumer performs RBAC authorization checks only for event groups that are mapped in the consumer_access() function (job_events, workflow_events, ad_hoc_command_events). Three event groups - inventory_update_events, project_update_events, and system_job_events — are not mapped, causing the authorization check to be skipped. Any authenticated user can subscribe to these unmapped websocket event groups for any object ID and receive real-time stdout output from jobs belonging to organizations they have no access to. This is an incomplete remediation of CVE-2020-10698.

• CWE-862

• https://access.redhat.com/security/cve/CVE-2026-16544
• https://bugzilla.redhat.com/show_bug.cgi?id=2506053

Published

Jul 22, 2026

Last Modified

Jul 22, 2026

Status

Awaiting Analysis

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-16517A signed integer overflow vulnerability was found in libarch…2.9
• CVE-2026-16519A DLL hijacking vulnerability exists in the GeoVision GV-IP …7.3
• CVE-2026-1652A potential buffer overflow vulnerability was reported in th…6.9
• CVE-2026-1653A potential divide by zero vulnerability was reported in the…6.8
• CVE-2026-1654The Peter's Date Countdown plugin for WordPress is vulnerabl…6.1
• CVE-2026-16543Kong Operator's embedded Kong Kubernetes Ingress Controller …7.1
• CVE-2026-1655The EventPrime plugin for WordPress is vulnerable to unautho…4.3
• CVE-2026-16551Denial-of-Service in Thinkst Applied Research OpenCanary (Mo…6.9
• CVE-2026-16552Rejected reason: The reported issue is invalid, as it requir…
• CVE-2026-16553GitLab has remediated an issue in GitLab EE affecting all ve…5.4
• CVE-2026-16554cJSON library is vulnerable to an integer overflow in the pr…5.1
• CVE-2026-1656The Business Directory Plugin for WordPress is vulnerable to…5.3