EUVD-2026-61012
GHSA-p5f2-j2p5-7p7v
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Network-reachable credential test with low complexity, but requires an authenticated credential-creation privilege (PR:L); token theft pivots into the cluster API (S:C) yielding high confidentiality and integrity, no availability impact.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in the AAP Controller's HashiCorp Vault credential plugin. The kubernetes_auth() function in awx_plugins/credentials/hashivault.py reads the controller pod's Kubernetes service account token and sends it to an attacker-controlled URL when a HashiCorp Vault Secret Lookup credential with kubernetes_role authentication is tested. An authenticated attacker with credential-creation privileges can exfiltrate the service account token, gaining Kubernetes API access to the control plane namespaces with full pod CRUD and secret read permissions, including database credentials and the Django SECRET_KEY.
Articles & Coverage 3
AnalysisAI
Server-side request forgery in the Red Hat Ansible Automation Platform 2 Controller's HashiCorp Vault credential plugin lets an authenticated user with credential-creation rights force the controller pod to leak its own Kubernetes service account token. When a HashiCorp Vault Secret Lookup credential configured for kubernetes_role authentication is tested, the kubernetes_auth() routine in awx_plugins/credentials/hashivault.py transmits the pod token to an attacker-supplied URL. With that token the attacker gains Kubernetes API access to control-plane namespaces, enabling full pod CRUD and secret reads including database credentials and the Django SECRET_KEY. No public exploit identified at time of analysis, and the flaw is not on the CISA KEV list.
Technical ContextAI
The affected component is the awx_plugins credential subsystem shipped with the AAP Controller (the AWX/Tower lineage), specifically the HashiCorp Vault integration in awx_plugins/credentials/hashivault.py. HashiCorp Vault's Kubernetes auth method normally works by having a client present its projected service account JWT to Vault, which validates it via the Kubernetes TokenReview API; here the plugin reads the controller pod's mounted service account token and POSTs it to the Vault address supplied in the credential definition. Because the destination URL is attacker-controlled input rather than a trusted, validated endpoint, the 'credential test' action becomes a classic CWE-918 Server-Side Request Forgery: the server is coerced into sending a sensitive internal secret to an arbitrary external location. The blast radius is amplified by the Kubernetes deployment model - the controller pod's service account is bound to roles in the control-plane namespaces, so the leaked token is not just a Vault credential but a key to the cluster's own API.
RemediationAI
No vendor-released patched version is identified in the available data, so the primary action is to monitor the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-12564 (and Bugzilla https://bugzilla.redhat.com/show_bug.cgi?id=2490556) and apply the AAP 2 errata as soon as Red Hat publishes them. As immediate compensating controls: tighten RBAC so that credential-creation privileges are granted only to trusted administrators, since exploitation depends on that privilege (trade-off: may disrupt self-service credential workflows); restrict egress network policy on the Controller pod so it can only reach known, trusted Vault endpoints, which blocks exfiltration to attacker-controlled URLs (trade-off: legitimate external Vault addresses must be allowlisted); and minimize the Controller pod's service account permissions in the control-plane namespaces so a leaked token yields less pod CRUD and secret-read power (trade-off: may break automation that relies on those permissions). Rotating the Django SECRET_KEY and database credentials is prudent if exposure is suspected.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today