Skip to content
Fencer Vulns
critical 9.6

CVE-2026-12564 json

Automation-controller: automation-controller: kubernetes service account token exfiltration via hashicorp vault credential ssrf

published 2026-08-18 2 mo ago modified 2026-11-04 4 d ago also EUVD-2026-61012

cvss
9.6
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 28%
public exploits
0
none known

Summary

A flaw was found in the AAP Controller's HashiCorp Vault credential plugin. The kubernetes_auth() function in awx_plugins/credentials/hashivault.py reads the controller pod's Kubernetes service account token and sends it to an attacker-controlled URL when a HashiCorp Vault Secret Lookup credential with kubernetes_role authentication is tested. An authenticated attacker with credential-creation privileges can exfiltrate the service account token, gaining Kubernetes API access to the control plane namespaces with full pod CRUD and secret read permissions, including database credentials and the Django SECRET_KEY.

Patch / fix

  • Red Hat Red Hat Ansible Automation Platform 2.4 for RHEL 8 0:4.5.36-1.el8ap
  • Red Hat Red Hat Ansible Automation Platform 2.4 for RHEL 9 0:4.5.36-1.el9ap
  • Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 0:4.6.33-1.el8ap
  • Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9 0:4.6.33-1.el9ap
  • Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9 0:4.7.17-1.el9ap
  • Red Hat Red Hat Ansible Automation Platform 2.6 1789673739
  • Red Hat Red Hat Ansible Automation Platform 2.7 1788918363
  • automation-controller-venv-tower ansible automation platform 2.4 4.5.36-1.el8ap
  • automation-controller-venv-tower ansible automation platform 2.4 4.5.36-1.el9ap
  • receptor ansible automation platform inside 2.5, ansible automation platform developer 2.5, ansible automation platform 2.5 1.6.8-1.el8ap
  • receptor ansible automation platform inside 2.6, ansible automation platform inside 2.5, ansible automation platform developer 2.6 +3 more 1.6.8-1.el9ap
  • python3.12-sqlparse ansible automation platform developer 2.5, ansible automation platform 2.5 0.6.0-1.el8ap
  • python3.12-sqlparse ansible automation platform developer 2.6, ansible automation platform developer 2.5, ansible automation platform 2.6 +1 more 0.6.0-1.el9ap
  • python3.12-gitpython ansible automation platform 2.5 3.1.60-1.el8ap
  • python3.12-gitpython ansible automation platform 2.6, ansible automation platform 2.5 3.1.60-1.el9ap

red hat advisories RHSA-2026:71115RHSA-2026:71114RHSA-2026:71113

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-12564 updated cvss 9.6

Automation-Controller: automation-controller: Kubernetes service account token exfiltration via HashiCorp Vault credential SSRF

  • Red Hat Ansible Automation Platform 2.4 for RHEL 8 automation-controller-venv-tower 4.5.36-1.el8ap Red Hat Ansible Automation Platform 2.4 for RHEL 9 automation-controller-venv-tower 4.5.36-1.el9ap
    fixed: vendor fix RHSA-2026:71115
  • Red Hat Ansible Automation Platform 2.5 for RHEL 8 automation-controller-venv-tower 4.6.33-1.el8ap Red Hat Ansible Automation Platform 2.5 for RHEL 9 automation-controller-venv-tower 4.6.33-1.el9ap
    fixed: vendor fix RHSA-2026:71114
  • Red Hat Ansible Automation Platform 2.6 ansible-automation-platform-26/controller-rhel9 1789673739
    fixed: vendor fix RHSA-2026:71179
  • Red Hat Ansible Automation Platform 2.6 for RHEL 9 automation-controller-venv-tower 4.7.17-1.el9ap
    fixed: vendor fix RHSA-2026:71113
  • Red Hat Ansible Automation Platform 2.7 ansible-automation-platform-27/controller-rhel9 1788918363
    fixed: vendor fix RHSA-2026:67279
  • Red Hat Ansible Automation Platform 2.4 for RHEL 8 automation-controller 4.5.36-1.el8ap, automation-controller-ui 4.5.36-1.el8ap, automation-controller-cli 4.5.36-1.el8ap, automation-controller-server 4.5.36-1.el8ap Red Hat Ansible Automation Platform 2.4 for RHEL 9 automation-controller 4.5.36-1.el9ap, automation-controller-ui 4.5.36-1.el9ap, automation-controller-cli 4.5.36-1.el9ap, automation-controller-server 4.5.36-1.el9ap Red Hat Ansible Automation Platform 2.5 for RHEL 8 receptor 1.6.8-1.el8ap, receptorctl 1.6.8-1.el8ap, automation-hub 4.10.19-1.el8ap, python3.12-sqlparse 0.6.0-1.el8ap, python3.12-gitpython 3.1.60-1.el8ap, automation-controller 4.6.33-1.el8ap, +14 more Red Hat Ansible Automation Platform 2.5 for RHEL 9 receptor 1.6.8-1.el9ap, receptorctl 1.6.8-1.el9ap, automation-hub 4.10.19-1.el9ap, python3.12-sqlparse 0.6.0-1.el9ap, python3.12-gitpython 3.1.60-1.el9ap, automation-controller 4.6.33-1.el9ap, +14 more Red Hat Ansible Automation Platform 2.6 ansible-automation-platform-26/hub-rhel9 1789611274, ansible-automation-platform-26/gateway-rhel9 1789666472, ansible-automation-platform-26/hub-web-rhel9 1789615881, ansible-automation-platform-26/receptor-rhel9 1789610120, ansible-automation-platform-26/mcp-tools-rhel9 1789609282, ansible-automation-platform-26/de-minimal-rhel9 1789658734, +24 more Red Hat Ansible Automation Platform 2.6 for RHEL 9 receptor 1.6.8-1.el9ap, receptorctl 1.6.8-1.el9ap, automation-hub 4.11.14-1.el9ap, python3.12-sqlparse 0.6.0-1.el9ap, python3.12-gitpython 3.1.60-1.el9ap, automation-controller 4.7.17-1.el9ap, +28 more
    +2 more products
    Red Hat Ansible Automation Platform 2.6 for RHEL 10 receptor 1.6.8-1.el10ap, receptorctl 1.6.8-1.el10ap, python-sqlparse 0.6.0-1.el10ap, python3-sqlparse 0.6.0-1.el10ap Red Hat Ansible Automation Platform 2.7 ansible-automation-platform-27/hub-rhel9 1788918708, ansible-automation-platform-27/gateway-rhel9 1788918510, ansible-automation-platform-27/hub-web-rhel9 1788924567, ansible-automation-platform-27/receptor-rhel9 1788918370, ansible-automation-platform-27/mcp-tools-rhel9 1788917342, ansible-automation-platform-27/de-minimal-rhel9 1788920534, +25 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
2 mo ago

Exploit prediction

0.35% chance of exploitation in the next 30 days, higher than 28% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 9.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Affected products

  • Red Hat Red Hat Ansible Automation Platform 2.4 for RHEL 8
  • Red Hat Red Hat Ansible Automation Platform 2.4 for RHEL 9
  • Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8
  • Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9
  • Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9
  • Red Hat Red Hat Ansible Automation Platform 2.6
  • Red Hat Red Hat Ansible Automation Platform 2.7

Classification

Weakness
  • CWE-918 Server-Side Request Forgery

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.