What’s Vulnerable › Vulnerabilities

CVE-2026-12564: Automation-controller: automation-controller: kubernetes service account token exfiltration via hashicorp vault credential ssrf

• Severity: critical (CVSS 9.6 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-18 · updated 2026-10-22
• Weakness: CWE-918

Description

A flaw was found in the AAP Controller's HashiCorp Vault credential plugin. The kubernetes_auth() function in awx_plugins/credentials/hashivault.py reads the controller pod's Kubernetes service account token and sends it to an attacker-controlled URL when a HashiCorp Vault Secret Lookup credential with kubernetes_role authentication is tested. An authenticated attacker with credential-creation privileges can exfiltrate the service account token, gaining Kubernetes API access to the control plane namespaces with full pod CRUD and secret read permissions, including database credentials and the Django SECRET_KEY.

Affected products

• Red Hat Ansible Automation Platform 2.4 for RHEL 8: all versions — fixed in 0:4.5.36-1.el8ap
• Red Hat Ansible Automation Platform 2.4 for RHEL 9: all versions — fixed in 0:4.5.36-1.el9ap
• Red Hat Ansible Automation Platform 2.5 for RHEL 8: all versions — fixed in 0:4.6.33-1.el8ap
• Red Hat Ansible Automation Platform 2.5 for RHEL 9: all versions — fixed in 0:4.6.33-1.el9ap
• Red Hat Ansible Automation Platform 2.6: all versions — fixed in 1789673739
• Red Hat Ansible Automation Platform 2.6 for RHEL 9: all versions — fixed in 0:4.7.17-1.el9ap
• Red Hat Ansible Automation Platform 2.7: all versions — fixed in 1788918363

How to fix

Upgrade to a fixed version: Red Hat Ansible Automation Platform 2.4 for RHEL 8 0:4.5.36-1.el8ap; Red Hat Ansible Automation Platform 2.4 for RHEL 9 0:4.5.36-1.el9ap; Red Hat Ansible Automation Platform 2.5 for RHEL 8 0:4.6.33-1.el8ap; Red Hat Ansible Automation Platform 2.5 for RHEL 9 0:4.6.33-1.el9ap; Red Hat Ansible Automation Platform 2.6 1789673739; Red Hat Ansible Automation Platform 2.6 for RHEL 9 0:4.7.17-1.el9ap; Red Hat Ansible Automation Platform 2.7 1788918363. Check the vendor advisory for mitigations.

References

• https://access.redhat.com/errata/RHSA-2026:67279
• https://access.redhat.com/errata/RHSA-2026:71113
• https://access.redhat.com/errata/RHSA-2026:71114
• https://access.redhat.com/errata/RHSA-2026:71115
• https://access.redhat.com/errata/RHSA-2026:71179
• https://access.redhat.com/security/cve/CVE-2026-12564
• https://bugzilla.redhat.com/show_bug.cgi?id=2490556

Get alerted when CVE-2026-12564 or the next vulnerability affects your stack