CVE-2026-75884 | BDVDB-2026-378128 Detail
Red HatRed Hat Ansible Automation Platform 2.4 for RHEL 8
Description#
A flaw was found in AWX. The container group pod_spec_override field uses an incomplete blocklist that only restricts automountServiceAccountToken, allowing injection of initContainers, serviceAccountName overrides, and projected service account token volumes. An AAP platform administrator can exploit this to escalate privileges to OpenShift namespace-level access and exfiltrate namespace secrets.
Impact#
Per CVSS v3.1: confidentiality impact high, integrity impact high, availability impact high. Attack vector: network.
Weaknesses#
- CWE-184 Incomplete List of Disallowed Inputs
References#
- https://access.redhat.com/errata/RHSA-2026:71113
- https://access.redhat.com/errata/RHSA-2026:71114
- https://access.redhat.com/errata/RHSA-2026:71115
- https://access.redhat.com/errata/RHSA-2026:71177
- https://access.redhat.com/errata/RHSA-2026:71179
- https://access.redhat.com/security/cve/CVE-2026-75884
- https://bugzilla.redhat.com/show_bug.cgi?id=2517893
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.