awxkit CVE-2026-52902

Exploitation requires all of the following: (1) the victim must have awxkit installed as part of Red Hat Ansible Automation Platform 2; (2) the victim must execute awx --conf.format yaml import explicitly using the --conf.format yaml flag, which activates YAML parsing with !include support - this is not the default CLI invocation mode; (3) the YAML file being imported must be attacker-controlled or attacker-influenced, meaning the victim was socially engineered or supplied a malicious file; (4) because AV:L, the malicious file must already exist on the victim's local filesystem at the time of the import command. Limiting factors that reduce real-world risk beyond the CVSS score: the attack is entirely client-side with no network exploitation path, high attack complexity (AC:H) reflects the social engineering and file delivery prerequisites, and the vulnerability only reads files that are YAML-parseable - binary files or non-YAML structured files will not yield usable output. The attack does not grant code execution, persistence, or write access.

The CVSS 4.7 Medium score accurately captures real-world risk here. The vector AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N decomposes as follows: local attack vector (attacker cannot exploit this remotely without first delivering a file), high attack complexity (attacker must craft a valid malicious YAML and convince a user to import it), no attacker privileges required, but user interaction is mandatory. The confidentiality impact is High - successful exploitation can expose arbitrary YAML-structured files (e.g., AWX credentials, SSH config, API tokens stored in YAML format) - but there is no integrity or availability risk. No EPSS score was provided in available data, precluding probabilistic exploitation comparison. No CISA KEV listing and no POC code identified at time of analysis, reinforcing this as a lower-urgency but genuine disclosure risk in developer or operator workflows where importing external YAML configs is routine. The primary realistic risk vector is supply-chain-adjacent: a malicious AWX export/config shared through a community repo or helpdesk ticket.

An attacker crafts a YAML file containing one or more !include directives referencing sensitive local paths such as !include ../../../../home/user/.ssh/config or !include ../../../etc/awx/credentials.yaml, then delivers it to an AWX operator via a forum post, Slack message, GitHub gist, or phishing email framed as a helpful automation template. When the operator runs awx --conf.format yaml import malicious.yaml, awxkit resolves the traversal paths and reads the targeted files, potentially surfacing their contents in CLI output or logs accessible to the attacker. No public POC code is identified, but the technique is straightforward to implement given the description.