CVE-2026-12564 Red Hat CVE debrief

Who should care

System administrators and security teams responsible for AAP Controller and HashiCorp Vault deployments, especially those with exposed credential-creation privileges, should assess their exposure and prioritize remediation.

Why it matters

CVE-2026-12564 is a critical vulnerability in the AAP Controller's HashiCorp Vault credential plugin that allows an authenticated attacker to exfiltrate service account tokens, potentially granting unauthorized Kubernetes API access. System administrators and security teams should assess their exposure, especially if credential-creation privileges are exposed to authenticated users, and prioritize remediation.

• Potential exfiltration of service account tokens granting Kubernetes API access.
• Possible unauthorized access to control plane namespaces with full pod CRUD and secret read permissions.
• Risk of exposure of database credentials and the Django SECRET_KEY.
• Need for verification of affected versions and remediation status.

Technical summary

The kubernetes_auth() function in awx_plugins/credentials/hashivault.py reads the controller pod's Kubernetes service account token and sends it to an attacker-controlled URL when a HashiCorp Vault Secret Lookup credential with kubernetes_role authentication is tested. This allows an authenticated attacker with credential-creation privileges to exfiltrate the service account token, potentially granting unauthorized Kubernetes API access. The vulnerability is caused by the insecure handling of service account tokens in the HashiCorp Vault credential plugin.

Defensive priority

High priority remediation is recommended for systems using the AAP Controller's HashiCorp Vault credential plugin, especially those with credential-creation privileges exposed to authenticated users.

Recommended defensive actions

• Immediately review and restrict credential-creation privileges for authenticated users in the AAP Controller's HashiCorp Vault credential plugin.
• Verify and apply any available patches or updates for the AAP Controller and HashiCorp Vault credential plugin.
• Monitor Kubernetes API access and service account token usage for suspicious activity.
• Consider implementing compensating controls, such as additional authentication or authorization mechanisms, to limit access to sensitive namespaces and secrets.
• Review and update incident response plans to include procedures for responding to potential exfiltration of service account tokens.
• Perform a thorough review of Kubernetes API access logs to detect any potential unauthorized access.
• Implement additional security measures, such as network segmentation or access controls, to limit the impact of a potential exploit.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score of 9.6 and severity of CRITICAL. Red Hat has provided references to errata and security pages for further information.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.