CVE-2026-12564

creationtimestamp| type| source ---|---|--- 2026-08-18 16:41:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/ifjsmmafl4fm2 2026-08-18 18:09:18+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mtesrpya5d2c 2026-08-18 18:10:04+00:00| seen|...

CVE-2026-12564

CVE-2026-12564 is a critical (CVSS 9.6) SSRF vulnerability in the AAP Controller's HashiCorp Vault credential plugin . The kubernetes_auth() function in awx_plugins/credentials/hashivault.py sends the controller pod's Kubernetes service account token to an attacker-controlled URL when a Vault Sec...