CVE-2026-76648 Automation-controller: automation-controller-container: aap controller: copyapiview.post() missing read authorization check enables job template secret recovery

CopyAPIView awx/awx/api/generics.py:873 sets permissionclasses = IsAuthenticated,, so DRF's getobject performs no object-level RBAC. The get handler lines 988–991 explicitly guards with request.user.canaccessobj.class, 'read', obj — but post lines 1001–1010 does not. POST only checks:...

CVE-2026-12564

A flaw was found in the AAP Controller's HashiCorp Vault credential plugin. The kubernetesauth function in awxplugins/credentials/hashivault.py reads the controller pod's Kubernetes service account token and sends it to an attacker-controlled URL when a HashiCorp Vault Secret Lookup credential wi...

CVE-2026-12564 Automation-controller: automation-controller: kubernetes service account token exfiltration via hashicorp vault credential ssrf

A flaw was found in the AAP Controller's HashiCorp Vault credential plugin. The kubernetesauth function in awxplugins/credentials/hashivault.py reads the controller pod's Kubernetes service account token and sends it to an attacker-controlled URL when a HashiCorp Vault Secret Lookup credential wi...

CVE-2026-12564

A flaw was found in the AAP Controller's HashiCorp Vault credential plugin. The kubernetesauth function in awxplugins/credentials/hashivault.py reads the controller pod's Kubernetes service account token and sends it to an attacker-controlled URL when a HashiCorp Vault Secret Lookup credential wi...

CVE-2026-12564 Automation-controller: automation-controller: kubernetes service account token exfiltration via hashicorp vault credential ssrf

A flaw was found in the AAP Controller's HashiCorp Vault credential plugin. The kubernetesauth function in awxplugins/credentials/hashivault.py reads the controller pod's Kubernetes service account token and sends it to an attacker-controlled URL when a HashiCorp Vault Secret Lookup credential wi...

EUVD-2026-61012

A flaw was found in the AAP Controller's HashiCorp Vault credential plugin. The kubernetesauth function in awxplugins/credentials/hashivault.py reads the controller pod's Kubernetes service account token and sends it to an attacker-controlled URL when a HashiCorp Vault Secret Lookup credential wi...

CVE-2026-12564

CVE-2026-12564 is a critical (CVSS 9.6) SSRF vulnerability in the AAP Controller's HashiCorp Vault credential plugin . The kubernetes_auth() function in awx_plugins/credentials/hashivault.py sends the controller pod's Kubernetes service account token to an attacker-controlled URL when a Vault Sec...

CVE-2026-12564

A flaw was found in the AAP Controller's HashiCorp Vault credential plugin. The kubernetesauth function in awxplugins/credentials/hashivault.py reads the controller pod's Kubernetes service account token and sends it to an attacker-controlled URL when a HashiCorp Vault Secret Lookup credential wi...

PT-2026-77167

A flaw was found in the AAP Controller's HashiCorp Vault credential plugin. The kubernetes auth function in awx plugins/credentials/hashivault.py reads the controller pod's Kubernetes service account token and sends it to an attacker-controlled URL when a HashiCorp Vault Secret Lookup credential...

CVE-2026-12564: Server-Side Request Forgery (SSRF)

A flaw was found in the AAP Controller's HashiCorp Vault credential plugin. The kubernetesauth function in awxplugins/credentials/hashivault.py reads the controller pod's Kubernetes service account token and sends it to an attacker-controlled URL when a HashiCorp Vault Secret Lookup credential wi...