Skip to content
CVE PROGRAM SOURCE RECORD9.1 Critical

CVE-2026-75884

Awx: awx: privilege escalation to openshift namespace via pod_spec_override injection in container groups

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
redhat

Description

A flaw was found in AWX. The container group pod_spec_override field uses an incomplete blocklist that only restricts automountServiceAccountToken, allowing injection of initContainers, serviceAccountName overrides, and projected service account token volumes. An AAP platform administrator can exploit this to escalate privileges to OpenShift namespace-level access and exfiltrate namespace secrets.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Red Hat Red Hat Ansible Automation Platform 2.4 for RHEL 8

Default version status: affected

  • 0:4.5.36-1.el8ap to < *unaffected

Red Hat Red Hat Ansible Automation Platform 2.4 for RHEL 9

Default version status: affected

  • 0:4.5.36-1.el9ap to < *unaffected

Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8

Default version status: affected

  • 0:4.6.33-1.el8ap to < *unaffected

Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9

Default version status: affected

  • 0:4.6.33-1.el9ap to < *unaffected

Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9

Default version status: affected

  • 0:4.7.17-1.el9ap to < *unaffected

Red Hat Red Hat Ansible Automation Platform 2.6

Default version status: affected

  • 1789673739 to < *unaffected

Red Hat Red Hat Ansible Automation Platform 2.7

Default version status: affected

  • 1789580684 to < *unaffected

References