The following practices would help for avoiding exposure and mitigate this flaw: - Restrict AWX/Controller user account creation to only trusted individuals. Since any authenticated user can exploit this flaw regardless of role, minimizing the number of user accounts reduces the attack surface. - Use external authentication (LDAP, SAML, OIDC) with strict group mappings to prevent self-registration and ensure only authorized users can log in. - Review the list of AWX/Controller users and remove or deactivate any accounts that are no longer needed. - Monitor websocket connections and subscriptions for unusual patterns, such as a user subscribing to inventory_update_events or project_update_events for object IDs outside their organization. - Avoid embedding credentials in SCM URLs or inventory source configurations, as these may appear in stdout output. Use credential objects instead. - Apply network segmentation to restrict access to the AWX/Controller web interface to trusted networks only.