Red HatCVE-2026-12564
Red Hat AAP Controller: server-side request forgery
Critical9.6CVE-2026-12564 · Published Aug 18, 2026 · updated Sep 24, 2026
A flaw was found in the AAP Controller's HashiCorp Vault credential plugin. The kubernetes_auth() function in awx_plugins/credentials/hashivault.py reads the controller pod's Kubernetes service account token and sends it to an attacker-controlled URL when a HashiCorp Vault Secret Lookup credential with kubernetes_role authentication is tested. An authenticated attacker with credential-creation privileges can exfiltrate the service account token, gaining Kubernetes API access to the control plane namespaces with full pod CRUD and secret read permissions, including database credentials and the Django SECRET_KEY.
Affected versions
The source does not list versions here. See the source advisory for affected products and fixes.
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
- Severity from
- the vendor (its own CVE record or advisory)
- Weakness
- CWE-918
- www.cve.org/CVERecord?id=CVE-2026-12564
- nvd.nist.gov/vuln/detail/CVE-2026-12564
- access.redhat.com/errata/RHSA-2026:67279
- access.redhat.com/errata/RHSA-2026:71113
- access.redhat.com/errata/RHSA-2026:71114
- access.redhat.com/errata/RHSA-2026:71115
- access.redhat.com/errata/RHSA-2026:71179
- access.redhat.com/security/cve/CVE-2026-12564
- bugzilla.redhat.com/show_bug.cgi?id=2490556
More Red Hat advisories
All Red Hat| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Aug 18 | A flaw was found in the legacy client-initiated account-linking endpoint of... | High7.3 | No fix yet |
| Aug 18 | Red Hat Advanced Cluster Management for Kubernetes 2: secrets in logs | Medium6.5 | No fix yet |
| Aug 18 | Red Hat Multicluster Engine for Kubernetes: information disclosure | High8.7 | No fix yet |
| Aug 18 | Red Hat Advanced Cluster Management for Kubernetes 2: information disclosure | Medium5.4 | No fix yet |
| Aug 18 | Red Hat Advanced Cluster Management: improper privilege management | Medium5.8 | No fix yet |
| Aug 18 | Red Hat Advanced Cluster Management for Kubernetes 2: code execution | Medium4.4 | No fix yet |