CVE-2026-12564

Name of the Vulnerable Software and Affected Versions AAP Controller (affected versions not specified)

Description A flaw exists in the HashiCorp Vault credential plugin of the AAP Controller. When a HashiCorp Vault Secret Lookup credential using kubernetes role authentication is tested, the kubernetes auth() function in awx plugins/credentials/hashivault.py reads the Kubernetes service account token of the controller pod and transmits it to an external URL controlled by an attacker. An authenticated attacker with privileges to create credentials can exfiltrate this token to obtain Kubernetes API access to control plane namespaces. This access allows full pod CRUD (Create, Read, Update, Delete) operations and the ability to read secrets, including database credentials and the SECRET KEY used by Django.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.