Description
A flaw was found in AWX. The container group pod_spec_override field uses an incomplete blocklist that only restricts automountServiceAccountToken, allowing injection of initContainers, serviceAccountName overrides, and projected service account token volumes. An AAP platform administrator can exploit this to escalate privileges to OpenShift namespace-level access and exfiltrate namespace secrets.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat Ansible Automation Platform 2.4 for RHEL 8 | — | — |
| Red Hat | Red Hat Ansible Automation Platform 2.4 for RHEL 9 | — | — |
| Red Hat | Red Hat Ansible Automation Platform 2.5 for RHEL 8 | — | — |
| Red Hat | Red Hat Ansible Automation Platform 2.5 for RHEL 9 | — | — |
| Red Hat | Red Hat Ansible Automation Platform 2.6 for RHEL 9 | — | — |
| Red Hat | Red Hat Ansible Automation Platform 2.6 | — | — |
| Red Hat | Red Hat Ansible Automation Platform 2.7 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Ansible Automation Platform Inside 2 | receptor | 1.6.8-1.el8ap | RHSA-2026:71114, RHSA-2026:71113 |
| Red Hat Ansible Automation Platform Developer 2 | automation-controller +1 | 4.7.17-1.el9ap | RHSA-2026:71113 |
| Red Hat Ansible Automation Platform Developer 2 | python-sqlparse +1 | 0.6.0-1.el10ap | RHSA-2026:71113 |
| Red Hat Ansible Automation Platform Developer 2 | python3.12-sqlparse | 0.6.0-1.el8ap | RHSA-2026:71114, RHSA-2026:71113 |
| Red Hat Ansible Automation Platform Developer 2 | receptor | 1.6.8-1.el8ap | RHSA-2026:71114, RHSA-2026:71113 |
| Red Hat Ansible Automation Platform 2 | automation-controller +3 | 4.7.17-1.el9ap | RHSA-2026:71113 |
| Red Hat Ansible Automation Platform 2 | automation-controller-venv-tower | 4.5.36-1.el8ap | RHSA-2026:71115, RHSA-2026:71114, RHSA-2026:71113 |
| Red Hat Ansible Automation Platform 2 | automation-gateway-proxy-server | 2.5.10-8.el8ap | RHSA-2026:71114, RHSA-2026:71113 |
| Red Hat Ansible Automation Platform 2 | automation-gateway-server | 2.5.20260923-1.el8ap | RHSA-2026:71114 |
| Red Hat Ansible Automation Platform 2 | automation-platform-ui | 2.6.14-1.el9ap | RHSA-2026:71113 |
| Red Hat Ansible Automation Platform 2 | python-sqlparse +1 | 0.6.0-1.el10ap | RHSA-2026:71113 |
| Red Hat Ansible Automation Platform 2 | python3.12-gitpython | 3.1.60-1.el8ap | RHSA-2026:71114, RHSA-2026:71113 |
| Red Hat Ansible Automation Platform 2 | python3.12-sqlparse | 0.6.0-1.el8ap | RHSA-2026:71114, RHSA-2026:71113 |
| Red Hat Ansible Automation Platform 2 | receptor | 1.6.8-1.el8ap | RHSA-2026:71114, RHSA-2026:71113 |
Advisories 4
- RHSA-2026:71114 Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:71115 Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:71113 Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- WID-SEC-2026-3555 Red Hat Ansible Automation Platform (automation-controller): Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 12, 2026
References
- RHSA-2026:71113 vendor-advisory
- RHSA-2026:71114 vendor-advisory
- RHSA-2026:71115 vendor-advisory
- RHSA-2026:71177 vendor-advisory
- RHSA-2026:71179 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-75884 vdb-entry
- RHBZ#2517893 issue-tracking