CVE-2026-12564: AAP Controller Privilege Escalation Flaw

CVE-2026-12564 Overview

CVE-2026-12564 is a Server-Side Request Forgery [CWE-918] vulnerability in the Ansible Automation Platform (AAP) Controller's HashiCorp Vault credential plugin. The kubernetes_auth() function in awx_plugins/credentials/hashivault.py reads the controller pod's Kubernetes service account token. It then sends that token to an attacker-controlled URL when a HashiCorp Vault Secret Lookup credential using kubernetes_role authentication is tested. An authenticated attacker with credential-creation privileges can exfiltrate the token and gain Kubernetes API access to control plane namespaces.

Critical Impact
Exfiltrated service account tokens grant full pod CRUD and secret read permissions, exposing database credentials and the Django SECRET_KEY.

Affected Products

Red Hat Ansible Automation Platform Controller
AWX (upstream awx_plugins/credentials/hashivault.py)
Deployments using HashiCorp Vault Secret Lookup credentials with kubernetes_role authentication

Discovery Timeline

2026-08-18 - CVE-2026-12564 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-12564

Vulnerability Analysis

The AAP Controller allows users to define HashiCorp Vault Secret Lookup credentials. When the credential specifies kubernetes_role as the authentication method, the kubernetes_auth() function in awx_plugins/credentials/hashivault.py reads the controller pod's mounted service account token. The function then issues an outbound HTTP request to the URL configured in the credential to perform Vault authentication.

The plugin does not validate or restrict the destination URL before transmitting the token. An authenticated user with credential-creation privileges can point the credential at an attacker-controlled endpoint and click the built-in test action. The controller sends its own Kubernetes service account bearer token to the attacker.

With the exfiltrated token, the attacker acquires the RBAC permissions bound to the controller service account. Those bindings include pod create, read, update, and delete operations, plus secret read access across control plane namespaces. Downstream consequences include disclosure of PostgreSQL credentials and the Django SECRET_KEY, which enables session forgery and further lateral movement.

Root Cause

The root cause is missing destination validation in the credential test path. The kubernetes_auth() routine treats the user-supplied Vault URL as trusted and attaches the pod's service account token to any outbound request built from that URL. This pattern maps directly to [CWE-918] Server-Side Request Forgery, with sensitive local credentials leaked to the attacker-controlled destination.

Attack Vector

Exploitation requires an authenticated account with permission to create or modify credentials in AAP Controller. The attacker creates a HashiCorp Vault Secret Lookup credential, selects kubernetes_role authentication, sets the Vault server URL to a host they control, and triggers the credential test. The controller pod then transmits its service account token to that host over the network.

The vulnerability manifests entirely in the credential plugin's authentication flow. See the Red Hat CVE-2026-12564 Advisory and Red Hat Bug Report #2490556 for vendor technical details.

Detection Methods for CVE-2026-12564

Indicators of Compromise

Outbound HTTPS requests from AAP Controller pods to unfamiliar or external hosts originating from the credential test workflow
New or recently modified HashiCorp Vault credentials with kubernetes_role authentication pointing at non-corporate Vault endpoints
Kubernetes API activity using the controller service account from IP addresses outside the cluster
Unexpected get, list, or create calls against secrets and pods resources in control plane namespaces

Detection Strategies

Audit AAP credential creation and edit events, correlating actor identity with new Vault URL values
Inspect egress traffic from controller pods and alert on connections to destinations outside an approved Vault allowlist
Enable Kubernetes API server audit logging and flag service account token use from unexpected source IPs or user agents

Monitoring Recommendations

Forward AAP Controller application logs and Kubernetes audit logs to a centralized analytics platform for correlation
Track credential test invocations and match them against the destination host reputation
Alert on any read of serviceaccount/token files from within controller pods followed by outbound traffic to non-Vault hosts

How to Mitigate CVE-2026-12564

Immediate Actions Required

Restrict the credential.add and credential.change permissions in AAP to a minimal set of trusted administrators
Review existing HashiCorp Vault credentials and remove or reconfigure any using kubernetes_role with untrusted URLs
Rotate the controller's Kubernetes service account token, PostgreSQL credentials, and Django SECRET_KEY if compromise is suspected
Apply vendor patches once released; refer to the Red Hat CVE-2026-12564 Advisory for fixed versions

Patch Information

Red Hat tracks the fix through advisory CVE-2026-12564 and bug #2490556. Consult the advisory for supported AAP Controller and AWX package versions containing the corrected kubernetes_auth() implementation.

Workarounds

Enforce a network policy that restricts controller pod egress to an approved list of Vault endpoints
Bind the controller service account to the least privilege required, removing broad secrets read and pods write permissions where possible
Disable the HashiCorp Vault credential type or the kubernetes_role authentication path until patches are applied

bash

# Example NetworkPolicy restricting AAP Controller egress to a trusted Vault host
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: aap-controller-egress
  namespace: aap
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/name: automation-controller
  policyTypes:
  - Egress
  egress:
  - to:
    - ipBlock:
        cidr: 10.0.50.10/32   # Trusted Vault endpoint
    ports:
    - protocol: TCP
      port: 8200