Critical

Automation-controller: automation-controller: kubernetes service account token exfiltration via hashicorp vault credential ssrf

Type: advisorySource: Official CVE List1 source record

A flaw was found in the AAP Controller's HashiCorp Vault credential plugin. The kubernetes_auth() function in awx_plugins/credentials/hashivault.py reads the controller pod's Kubernetes service account token and sends it to an attacker-controlled URL when a HashiCorp Vault Secret Lookup credential with kubernetes_role authentication is tested. An authenticated attacker with credential-creation privileges can exfiltrate the service account token, gaining Kubernetes API access to the control plane namespaces with full pod CRUD and secret read permissions, including database credentials and the Django SECRET_KEY.

Announced 18 Aug 2026Group revision 1

Original source ↗

CVE-2026-12564

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-12564

Red Hat Ansible Automation Platform 2.4 for RHEL 8

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Ansible Automation Platform 2.4 for RHEL 9

Source reference: /containers/cna/affected/1/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Ansible Automation Platform 2.5 for RHEL 8

Source reference: /containers/cna/affected/2/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Ansible Automation Platform 2.5 for RHEL 9

Source reference: /containers/cna/affected/3/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Ansible Automation Platform 2.6 for RHEL 9

Source reference: /containers/cna/affected/4/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Ansible Automation Platform 2.6

Source reference: /containers/cna/affected/5/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Ansible Automation Platform 2.7

Source reference: /containers/cna/affected/6/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "cpes": [
      "cpe:/a:redhat:ansible_automation_platform:2.4::el8",
      "cpe:/a:redhat:ansible_automation_platform:2.4::el9",
      "cpe:/a:redhat:ansible_automation_platform_developer:2.4::el8",
      "cpe:/a:redhat:ansible_automation_platform_developer:2.4::el9"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat Ansible Automation Platform 2.4 for RHEL 8",
    "versions": [
      {
        "status": "unaffected",
        "version": "0:4.5.36-1.el8ap",
        "lessThan": "*",
        "versionType": "rpm"
      }
    ],
    "packageName": "automation-controller",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:ansible_automation_platform:2.4::el8",
      "cpe:/a:redhat:ansible_automation_platform:2.4::el9",
      "cpe:/a:redhat:ansible_automation_platform_developer:2.4::el8",
      "cpe:/a:redhat:ansible_automation_platform_developer:2.4::el9"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat Ansible Automation Platform 2.4 for RHEL 9",
    "versions": [
      {
        "status": "unaffected",
        "version": "0:4.5.36-1.el9ap",
        "lessThan": "*",
        "versionType": "rpm"
      }
    ],
    "packageName": "automation-controller",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:ansible_automation_platform:2.5::el8",
      "cpe:/a:redhat:ansible_automation_platform:2.5::el9",
      "cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8",
      "cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9",
      "cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8",
      "cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat Ansible Automation Platform 2.5 for RHEL 8",
    "versions": [
      {
        "status": "unaffected",
        "version": "0:4.6.33-1.el8ap",
        "lessThan": "*",
        "versionType": "rpm"
      }
    ],
    "packageName": "automation-controller",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:ansible_automation_platform:2.5::el8",
      "cpe:/a:redhat:ansible_automation_platform:2.5::el9",
      "cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8",
      "cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9",
      "cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8",
      "cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat Ansible Automation Platform 2.5 for RHEL 9",
    "versions": [
      {
        "status": "unaffected",
        "version": "0:4.6.33-1.el9ap",
        "lessThan": "*",
        "versionType": "rpm"
      }
    ],
    "packageName": "automation-controller",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:ansible_automation_platform:2.6::el10",
      "cpe:/a:redhat:ansible_automation_platform:2.6::el9",
      "cpe:/a:redhat:ansible_automation_platform_developer:2.6::el10",
      "cpe:/a:redhat:ansible_automation_platform_developer:2.6::el9",
      "cpe:/a:redhat:ansible_automation_platform_inside:2.6::el9"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat Ansible Automation Platform 2.6 for RHEL 9",
    "versions": [
      {
        "status": "unaffected",
        "version": "0:4.7.17-1.el9ap",
        "lessThan": "*",
        "versionType": "rpm"
      }
    ],
    "packageName": "automation-controller",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:ansible_automation_platform:2.6::el9"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat Ansible Automation Platform 2.6",
    "versions": [
      {
        "status": "unaffected",
        "version": "1789673739",
        "lessThan": "*",
        "versionType": "rpm"
      }
    ],
    "packageName": "ansible-automation-platform-26/controller-rhel9",
    "collectionURL": "https://catalog.redhat.com/software/containers/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:ansible_automation_platform:2.7::el9"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat Ansible Automation Platform 2.7",
    "versions": [
      {
        "status": "unaffected",
        "version": "1788918363",
        "lessThan": "*",
        "versionType": "rpm"
      }
    ],
    "packageName": "ansible-automation-platform-27/controller-rhel9",
    "collectionURL": "https://catalog.redhat.com/software/containers/",
    "defaultStatus": "affected"
  }
]

Related CVEs: CVE-2026-12564
Source reference: /cveMetadata/cveId

Publisher severity

critical

Source reference: /containers/cna/metrics

Event: #520 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 20:47:05 GMT
Publisher date: Tue, 18 Aug 2026 15:50:54 GMT

Read the original announcement

Revision history

24 Oct 2026CVE-2026-12564 · Revision 1Source updated