CVE-2026-12564

creationtimestamp| type| source ---|---|--- 2026-08-18 16:41:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/ifjsmmafl4fm2 2026-08-18 18:09:18+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mtesrpya5d2c 2026-08-18 18:10:04+00:00| seen|...

CVE-2026-12564 Automation-controller: automation-controller: kubernetes service account token exfiltration via hashicorp vault credential ssrf

A flaw was found in the AAP Controller's HashiCorp Vault credential plugin. The kubernetesauth function in awxplugins/credentials/hashivault.py reads the controller pod's Kubernetes service account token and sends it to an attacker-controlled URL when a HashiCorp Vault Secret Lookup credential wi...

CVE-2026-12564

CVE-2026-12564 is a critical (CVSS 9.6) SSRF vulnerability in the AAP Controller's HashiCorp Vault credential plugin . The kubernetes_auth() function in awx_plugins/credentials/hashivault.py sends the controller pod's Kubernetes service account token to an attacker-controlled URL when a Vault Sec...