A flaw was found in the AAP Controller's HashiCorp Vault credential plugin. The kubernetes_auth() function in awx_plugins/credentials/hashivault.py reads the controller pod's Kubernetes service account token and sends it to an attacker-controlled URL when a HashiCorp Vault Secret Lookup credential with kubernetes_role authentication is tested. An authenticated attacker with credential-creation privileges can exfiltrate the service account token, gaining Kubernetes API access to the control plane namespaces with full pod CRUD and secret read permissions, including database credentials and the Django SECRET_KEY.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Redhat_linux | — | Upgrade automation-platform-uiUpgrade aap-metrics-utilityUpgrade python3.12-django-ansible-base+api_documentationUpgrade automation-eda-controller-event-stream-servicesUpgrade python3.12-django-ansible-base+redis_clientUpgrade automation-gatewayUpgrade receptorctlUpgrade automation-controller-venv-towerUpgrade automation-eda-controllerUpgrade automation-hubUpgrade python3.12-django-ansible-base+feature_flagsUpgrade automation-gateway-proxy-server-debuginfoUpgrade python3-sqlparseUpgrade automation-controller-cliUpgrade automation-controller-serverUpgrade automation-gateway-configUpgrade python3.12-django-ansible-baseUpgrade python3.12-django-ansible-base+rbacUpgrade automation-gateway-serverUpgrade receptorUpgrade python3.12-django-ansible-base+resource_registryUpgrade automation-eda-controller-worker-servicesUpgrade python3.12-gitpythonUpgrade python3.12-django-ansible-base+channel_authUpgrade automation-eda-controller-baseUpgrade automation-eda-controller-base-servicesUpgrade python3.12-django-ansible-base+oauth2_providerUpgrade python3.12-django-ansible-base+authenticationUpgrade python3.12-sqlparseUpgrade automation-controller-uiUpgrade python3.12-django-ansible-base+rest_filtersUpgrade python3.12-django-ansible-base+jwt_consumerUpgrade automation-gateway-proxy-debugsourceUpgrade receptor-debugsourceUpgrade automation-gateway-proxy-serverUpgrade receptor-debuginfoUpgrade automation-controllerUpgrade python3.12-galaxy-ngUpgrade python3.12-django-ansible-base+activitystreamUpgrade automation-gateway-proxy | Sep 25, 2026 | Jul 17, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub