5.3
CVSS V3
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Impact
awx 24.6.1 pins daphne==3.0.2 with channels==3.0.5, which declares daphne<4. This CVE is fixed only in daphne 4.2.2.
Bumping daphne to 4.x breaks awx-manage runserver: it flips onto the channels
ASGI server, and AWX's REST layer is not ASGI-safe — awx/api/generics.py:164
reads request.environ, which AsgiRequest lacks, so API requests fail. Verified
on the built package with the same database and redis: HTTP 200 on daphne
3.0.2, HTTP 500 on 4.2.3. Remediation needs channels 4 plus an upstream fix to
AWX's DRF request handling.
Status
Impact
CVE-2026-44546/GHSA-xh68-hfp5-5x5m affects the Python package daphne < 4.2.2. awx ships Django Channels 3.x stack which pins daphne >=3.0,<4; fixing this vulnerability would require migrating awx to the the Channels 4.x stack. Upstream awx tip of main has migrated to Channel 4.x (although not with the fixed version of daphne) but upstream maintainers will need to release those changes as a tagged version.
Status