Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-12564 |
| Alert Source | GitHub Advisory - Critical Vulnerability |
| CVE Publication Year | 2026 |
| Date Published | 2026-08-18 |
| Vendor | Red Hat |
| Product | Ansible Automation Platform |
| CVSS Score | 9.6 (critical) |
| EPSS Score | No data |
| CISA KEV | No |
| Ransomware | Not confirmed |
Vulnerability Description
A flaw was found in the AAP Controller’s HashiCorp Vault credential plugin. The kubernetes_auth() function in awx_plugins/credentials/hashivault.py reads the controller pod’s Kubernetes service account token and sends it to an attacker-controlled URL when a HashiCorp Vault Secret Lookup credential with kubernetes_role authentication is tested. An authenticated attacker with credential-creation privileges can exfiltrate the service account token, gaining Kubernetes API access to the control plane…
Required Actions
- Apply the Red Hat fix for Ansible Automation Platform per the advisory for CVE-2026-12564.
- Understand the escalation path: the attacker does not need AAP administrator rights — the ability to create credentials is enough, and that permission is granted relatively broadly. The stolen service account token, meanwhile, grants Kubernetes API access with the controller’s privileges.
- After updating, rotate the service account token of the controller pod. The patch alone does not invalidate credentials that may already have leaked.
- Review HashiCorp Vault Secret Lookup credentials for unusual Vault server URLs. An address pointing outside your infrastructure is a sign of an exploitation attempt.
- Verify who in AAP holds credential-creation rights — this vulnerability effectively turns that permission into cluster takeover.
Who Is Affected?
Organizations running Red Hat Ansible Automation Platform on Kubernetes or OpenShift with HashiCorp Vault credential integration configured. This typically covers automation and infrastructure teams in larger environments.
Sources
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
