CVE-2026-12564
Last modified
CVE-2026-12564 is a critical-severity vulnerability rated 9.6/10 on the CVSS scale. A flaw was found in the AAP Controller's HashiCorp Vault credential plugin. The kubernetes_auth() function in awx_plugins/credentials/hashivault.py reads the controller pod's Kubernetes service account token and sends it to an attacker-controlled URL when a HashiCorp Vault Secret Lookup credential with kubernetes_role authentication is tested. EPSS estimates a 0.30% chance of exploitation in the next 30 days.
Description
A flaw was found in the AAP Controller's HashiCorp Vault credential plugin. The kubernetes_auth() function in awx_plugins/credentials/hashivault.py reads the controller pod's Kubernetes service account token and sends it to an attacker-controlled URL when a HashiCorp Vault Secret Lookup credential with kubernetes_role authentication is tested. An authenticated attacker with credential-creation privileges can exfiltrate the service account token, gaining Kubernetes API access to the control plane namespaces with full pod CRUD and secret read permissions, including database credentials and the Django SECRET_KEY.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat Ansible Automation Platform 2.4 for RHEL 8 | All versions |
| Red Hat | Red Hat Ansible Automation Platform 2.4 for RHEL 9 | All versions |
| Red Hat | Red Hat Ansible Automation Platform 2.5 for RHEL 8 | All versions |
| Red Hat | Red Hat Ansible Automation Platform 2.5 for RHEL 9 | All versions |
| Red Hat | Red Hat Ansible Automation Platform 2.6 for RHEL 9 | All versions |
| Red Hat | Red Hat Ansible Automation Platform 2.6 | All versions |
| Red Hat | Red Hat Ansible Automation Platform 2.7 | All versions |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2026-12564?
How severe is CVE-2026-12564?
How do I fix CVE-2026-12564?
How Strix Helps
- One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-12557The Ninja Forms - File Uploads plugin for WordPress is vulne…5.3
- CVE-2026-12559A Stored Cross-Site Scripting (XSS) vulnerability has been i…7.3
- CVE-2026-1256The YS LeadGen plugin for WordPress is vulnerable to authori…6.4
- CVE-2026-12560The Editorial Rating – Product Review & Rating System plugin…4.4
- CVE-2026-12561The tagDiv Composer plugin for WordPress is vulnerable to St…6.4
- CVE-2026-12562The RCU II+ and Multiload II+ are vulnerable to an unauthent…8.8
- CVE-2026-12565The unarchive internal module's archive extraction commands …5.3
- CVE-2026-12566The docker_pull module uses the realm parameter from a Docke…3.1
- CVE-2026-12567The github_workflows module constructs local directory paths…2.2
- CVE-2026-12568The postman_download module uses the workspace name field fr…6.5
- CVE-2026-12569A critical remote code execution (RCE) vulnerability has bee…9.8
- CVE-2026-1257The Administrative Shortcodes plugin for WordPress is vulner…7.5
Are you affected by CVE-2026-12564?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST