Description
An improper authorization flaw exists in the Ansible Automation Controller. This flaw allows an attacker using the k8S API server to send an HTTP request with a service account token mounted via `automountServiceAccountToken: true`, resulting in privilege escalation to a service account.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
automation-controller
Default version status: unaffected
4.5.10-1 to < 4.5.10-1affected
Red Hat Red Hat Ansible Automation Platform 2.4 for RHEL 8
Default version status: affected
0:4.5.10-1.el8ap to < *unaffected
Red Hat Red Hat Ansible Automation Platform 2.4 for RHEL 9
Default version status: affected
0:4.5.10-1.el9ap to < *unaffected