CVEvulnerability
CVE-2026-12564
9.6 CRITICAL
Official page ↗
- Status
- Awaiting Analysis
- Published
- 2026-08-18
- Last modified
- 2026-10-22
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.6 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
- Weaknesses
- CWE-918
Description
A flaw was found in the AAP Controller's HashiCorp Vault credential plugin. The kubernetes_auth() function in awx_plugins/credentials/hashivault.py reads the controller pod's Kubernetes service account token and sends it to an attacker-controlled URL when a HashiCorp Vault Secret Lookup credential with kubernetes_role authentication is tested. An authenticated attacker with credential-creation privileges can exfiltrate the service account token, gaining Kubernetes API access to the control plane namespaces with full pod CRUD and secret read permissions, including database credentials and the Django SECRET_KEY.
Related
Weakness · CWE (1)
- CWE-918 Server-Side Request Forgery weakness
References
- https://access.redhat.com/errata/RHSA-2026:67279 access.redhat.com
- https://access.redhat.com/errata/RHSA-2026:71113 access.redhat.com
- https://access.redhat.com/errata/RHSA-2026:71114 access.redhat.com
- https://access.redhat.com/errata/RHSA-2026:71115 access.redhat.com
- https://access.redhat.com/errata/RHSA-2026:71179 access.redhat.com
- https://access.redhat.com/security/cve/CVE-2026-12564 access.redhat.com
- https://bugzilla.redhat.com/show_bug.cgi?id=2490556 bugzilla.redhat.com