54 matches found
CVE-2026-12564
A flaw was found in the AAP Controller's HashiCorp Vault credential plugin. The kubernetesauth function in awxplugins/credentials/hashivault.py reads the controller pod's Kubernetes service account token and sends it to an attacker-controlled URL when a HashiCorp Vault Secret Lookup credential wi...
CVE-2026-12564
A flaw was found in the AAP Controller's HashiCorp Vault credential plugin. The kubernetesauth function in awxplugins/credentials/hashivault.py reads the controller pod's Kubernetes service account token and sends it to an attacker-controlled URL when a HashiCorp Vault Secret Lookup credential wi...
CVE-2026-12564 Automation-controller: automation-controller: kubernetes service account token exfiltration via hashicorp vault credential ssrf
A flaw was found in the AAP Controller's HashiCorp Vault credential plugin. The kubernetesauth function in awxplugins/credentials/hashivault.py reads the controller pod's Kubernetes service account token and sends it to an attacker-controlled URL when a HashiCorp Vault Secret Lookup credential wi...
CVE-2026-12564
CVE-2026-12564 is a critical (CVSS 9.6) SSRF vulnerability in the AAP Controller's HashiCorp Vault credential plugin . The kubernetes_auth() function in awx_plugins/credentials/hashivault.py sends the controller pod's Kubernetes service account token to an attacker-controlled URL when a Vault Sec...
EUVD-2026-61012
A flaw was found in the AAP Controller's HashiCorp Vault credential plugin. The kubernetesauth function in awxplugins/credentials/hashivault.py reads the controller pod's Kubernetes service account token and sends it to an attacker-controlled URL when a HashiCorp Vault Secret Lookup credential wi...
PT-2026-77167
A flaw was found in the AAP Controller's HashiCorp Vault credential plugin. The kubernetes auth function in awx plugins/credentials/hashivault.py reads the controller pod's Kubernetes service account token and sends it to an attacker-controlled URL when a HashiCorp Vault Secret Lookup credential...
CVE-2026-18141 Aap-gateway: aap-gateway: authentication bypass in event-driven ansible via forged http header
A flaw was found in aap-gateway, a component of Ansible Automation Platform's Event-Driven Ansible EDA. An unauthenticated remote attacker can bypass mutual Transport Layer Security mTLS authentication for event streams. This is achieved by manipulating the event stream URL and forging the HTTP...
CVE-2026-18141 Aap-gateway: aap-gateway: authentication bypass in event-driven ansible via forged http header
A flaw was found in aap-gateway, a component of Ansible Automation Platform's Event-Driven Ansible EDA. An unauthenticated remote attacker can bypass mutual Transport Layer Security mTLS authentication for event streams. This is achieved by manipulating the event stream URL and forging the HTTP...
CVE-2026-18141
The CVE-2026-18141 entry concerns aap-gateway in Ansible Automation Platform’s Event-Driven Ansible (EDA). Affected component: aap-gateway. Vulnerability: an unauthenticated remote attacker can bypass mutual TLS on event streams by manipulating the event stream URL and forging the HTTP Subject he...
CVE-2026-18141
A flaw was found in aap-gateway, a component of Ansible Automation Platform's Event-Driven Ansible EDA. An unauthenticated remote attacker can bypass mutual Transport Layer Security mTLS authentication for event streams. This is achieved by manipulating the event stream URL and forging the HTTP...
CVE-2026-12382 Aap-gateway: missing requestheaderstoremove allows mtls bypass via subject header spoofing
A flaw was found in the AAP Gateway Envoy proxy configuration. The non-mTLS route to EDA event streams does not remove the Subject HTTP header from client requests, despite the source code defining requestHeadersToRemove for this header. An unauthenticated remote attacker can inject a spoofed...
CVE-2026-12382 Aap-gateway: missing requestheaderstoremove allows mtls bypass via subject header spoofing
A flaw was found in the AAP Gateway Envoy proxy configuration. The non-mTLS route to EDA event streams does not remove the Subject HTTP header from client requests, despite the source code defining requestHeadersToRemove for this header. An unauthenticated remote attacker can inject a spoofed...
PT-2026-60230
Name of the Vulnerable Software and Affected Versions Ansible Automation Platform affected versions not specified Description A flaw in the AAP Gateway Envoy proxy configuration allows an unauthenticated remote attacker to bypass mTLS authentication. The non-mTLS route to EDA event streams fails ...
aap-gateway: missing requestHeadersToRemove allows mTLS bypass via Subject header spoofing
A flaw was found in the AAP Gateway Envoy proxy configuration. The non-mTLS route to EDA event streams does not remove the Subject HTTP header from client requests, despite the source code defining requestHeadersToRemove for this header. An unauthenticated remote attacker can inject a spoofed...
CVE-2026-6266 Aap-controller: aap-gateway: account hijacking and unauthorized access via unverified email linking
A flaw was found in the AAP gateway. The user auto-link strategy, introduced in AAP 2.6, automatically links an external Identity Provider IDP identity to an existing AAP user account based on email matching without verifying email ownership. This allows a remote attacker to potentially hijack a...
EUVD-2026-26967
A flaw was found in the AAP gateway. The user auto-link strategy, introduced in AAP 2.6, automatically links an external Identity Provider IDP identity to an existing AAP user account based on email matching without verifying email ownership. This allows a remote attacker to potentially hijack a...
CVE-2026-6266
A flaw was found in the AAP gateway. The user auto-link strategy, introduced in AAP 2.6, automatically links an external Identity Provider IDP identity to an existing AAP user account based on email matching without verifying email ownership. This allows a remote attacker to potentially hijack a...
EUVD-2026-23400
A flaw was found in the AAP MCP server. An unauthenticated remote attacker can exploit a log injection vulnerability by sending specially crafted input to the toolsetroute parameter. This parameter is not properly sanitized before being written to logs, allowing the attacker to inject control...
CVE-2026-6494
CVE-2026-6494 describes a log-injection vulnerability in the AAP MCP server. An unauthenticated remote attacker can send specially crafted input to the toolsetroute parameter, which is written to logs without proper sanitization. This allows insertion of control characters (e.g., newlines and ANS...