Description
When running Tower before 3.4.3 on OpenShift or Kubernetes, application credentials are exposed to playbook job runs via environment variables. A malicious user with the ability to write playbooks could use this to gain administrative privileges.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Tower | 3.3.5, 3.4.3 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat CloudForms 5 | ansible-tower +5 | 3.4.3-1.el7at | RHSA-2019:0796 |
| Red Hat CloudForms 5 | cfme +5 | 5.10.3.3-1.el7cf | RHSA-2019:0796 |
Advisories 1
- RHSA-2019:0796 Red Hat Security Advisory: CloudForms 4.7.3 security, bug fix and enhancement update Red Hat Security Advisories (RHSA) · Jun 28, 2026