CVE-2026-84708
Description
A flaw was found in Red Hat Ansible Automation Platform's automation-controller. A user with the delegated Instance Group Admin role on a container group can set a free-form pod specification override that is deep-merged, without filtering, into every job pod launched on that group. The only hardening applied is forcing automountServiceAccountToken to false, which does not remove an explicitly declared projected serviceAccountToken volume or secret volume mounts. A non-superuser can therefore cause the kubelet to mint a ServiceAccount token for the control-plane automation-controller service account into the job container and mount arbitrary secrets from the control-plane namespace, obtaining the control-plane service-account identity on the Kubernetes API and cleartext control-plane secrets (including the platform database password and Django SECRET_KEY), leading to full platform data compromise.
Statement
This flaw affects automation-controller as shipped in Red Hat Ansible Automation Platform deployments that use container groups (Kubernetes/OpenShift execution). Exploitation requires an authenticated user with the Instance Group admin role on a container group (superuser is not required). The impact is compromise of the control-plane service-account identity on the Kubernetes API and cleartext disclosure of control-plane namespace secrets — including the platform database password and Django SECRET_KEY — leading to full platform data compromise. The realized severity depends on whether the deployment strips service-account-token volumes (tower#7523) and runs job pods in a dedicated namespace with a reduced-RBAC service account (awx-operator#2122); both were absent on the tested system. Red Hat recommends stripping projected serviceAccountToken and secret volumes from pod_spec_override at both the serializer and the runtime dispatch, pinning serviceAccountName/namespace, and adopting the dedicated job namespace with minimal RBAC.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 8.7 | N/A | N/A |
| Attack Vector | Network | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | High | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Changed | N/A | N/A |
| Confidentiality | High | N/A | N/A |
| Integrity Impact | High | N/A | N/A |
| Availability Impact | None | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
Understanding the Weakness (CWE)
Access Control
Technical Impact: Gain Privileges or Assume Identity
A user can access restricted functionality and/or sensitive information that may include administrative functionality and user accounts.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
