The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
A flaw was found in the AAP Controller's HashiCorp Vault credential plugin. The kubernetes_auth() function in awx_plugins/credentials/hashivault.py reads the controller pod's Kubernetes service account token and sends it to an attacker-controlled URL when a HashiCorp Vault Secret Lookup credential with kubernetes_role authentication is tested. An authenticated attacker with credential-creation privileges can exfiltrate the service account token, gaining Kubernetes API access to the control plane namespaces with full pod CRUD and secret read permissions, including database credentials and the Django SECRET_KEY.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Redhat_linux | — | Upgrade automation-gateway-proxy-debugsourceUpgrade receptor-debuginfoUpgrade automation-gateway-proxyUpgrade automation-eda-controller-baseUpgrade python3.12-gitpythonUpgrade automation-eda-controller-base-servicesUpgrade python3.12-django-ansible-base+rest_filtersUpgrade python3.12-galaxy-ngUpgrade python3.12-django-ansible-base+oauth2_providerUpgrade python3.12-sqlparseUpgrade python3.12-django-ansible-base+jwt_consumerUpgrade automation-controller-uiUpgrade python3.12-django-ansible-base+authenticationUpgrade automation-controllerUpgrade automation-eda-controller-worker-servicesUpgrade receptor-debugsourceUpgrade python3.12-django-ansible-base+activitystreamUpgrade automation-gateway-proxy-serverUpgrade python3.12-django-ansible-base+channel_authUpgrade automation-hubUpgrade automation-eda-controller-event-stream-servicesUpgrade receptorctlUpgrade automation-controller-cliUpgrade receptorUpgrade python3.12-django-ansible-base+rbacUpgrade automation-gateway-configUpgrade python3.12-django-ansible-baseUpgrade python3-sqlparseUpgrade aap-metrics-utilityUpgrade automation-controller-venv-towerUpgrade automation-gateway-proxy-server-debuginfoUpgrade python3.12-django-ansible-base+api_documentationUpgrade automation-eda-controllerUpgrade automation-controller-serverUpgrade python3.12-django-ansible-base+feature_flagsUpgrade automation-gatewayUpgrade python3.12-django-ansible-base+resource_registryUpgrade automation-platform-uiUpgrade automation-gateway-serverUpgrade python3.12-django-ansible-base+redis_client | Sep 25, 2026 | Jul 17, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub