CVE-2026-12564

CriticalCVSS 9.6/10Last modified Oct 22, 2026

Description

A flaw was found in the AAP Controller's HashiCorp Vault credential plugin. The kubernetes_auth() function in awx_plugins/credentials/hashivault.py reads the controller pod's Kubernetes service account token and sends it to an attacker-controlled URL when a HashiCorp Vault Secret Lookup credential with kubernetes_role authentication is tested. An authenticated attacker with credential-creation privileges can exfiltrate the service account token, gaining Kubernetes API access to the control plane namespaces with full pod CRUD and secret read permissions, including database credentials and the Django SECRET_KEY.

Metrics

CVSS 3.1 9.6/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Weakness enumeration

CWE-918

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Aug 18, 2026
Last modified
Oct 22, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-125655.3The unarchive internal module's archive extraction commands perform no code-level validation on extracted file paths, relying entirely on thCVE-2026-125663.1The docker_pull module uses the realm parameter from a Docker registry's WWW-Authenticate response header as the authentication endpoint witCVE-2026-125672.2The github_workflows module constructs local directory paths from user-controlled repository names without validating for symlinks. A local CVE-2026-125686.5The postman_download module uses the workspace name field from the Postman API to construct the local directory path without sanitization. ICVE-2026-125699.8A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill PDMlink and PTC FlexPLM. The vulnerability may be exCVE-2026-12577.5The Administrative Shortcodes plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 0.3.4 via theCVE-2026-125705.5A vulnerability in keras-team/keras versions <= 3.15.0 allows for a denial of service (DoS) attack when loading malicious .keras model filesCVE-2026-125719.8An authentication bypass in ManageEngine DDI Central's password-reset workflow allows account takeover.CVE-2026-125757.5DVP80ES3 with  Improper Resource Shutdown or Release vulnerability.CVE-2026-125767.5DVP80ES3 with Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability.CVE-2026-125778.7DVP80ES3 with Improperly Implemented Security Check for Standard vulnerability.CVE-2026-125788.4The affected product is vulnerable to a deserialization of untrusted data, which may allow an attacker to execute arbitrary code.