Critical Vulnerability in Ansible Automation Platform Exposes Kubernetes Tokens

A new security vulnerability, identified as CVE-2026-12564, was disclosed on August 18, 2026, affecting the HashiCorp Vault credential plugin within Red Hat Ansible Automation Platform. The flaw specifically resides in the `kubernetes_auth()` function of `awx_plugins/credentials/hashivault.py`. This vulnerability allows an authenticated attacker, possessing credential-creation privileges, to exfiltrate Kubernetes service account tokens. The mechanism involves the function reading the controller pod's Kubernetes service account token and sending it to an attacker-controlled URL when a HashiCorp Vault Secret Lookup credential with `kubernetes_role` authentication is tested. This vulnerability is of significant concern for organizations leveraging Ansible Automation Platform for managing Kubernetes environments. The exfiltration of Kubernetes service account tokens grants attackers broad access to the Kubernetes API, including the ability to perform Create, Read, Update, and Delete (CRUD) operations on pods, as well as read sensitive secrets. This level of access can lead to severe compromises, such as data breaches, unauthorized resource manipulation, and further lateral movement within the compromised Kubernetes clusters. For DevOps and cloud security teams, this directly impacts the integrity and confidentiality of their automated infrastructure. The increasing integration of automation platforms like Ansible with cloud-native technologies, particularly Kubernetes, introduces new attack surfaces. As organizations strive for Infrastructure as Code (IaC) and GitOps principles, the security of credential management and secrets orchestration becomes paramount. HashiCorp Vault is a widely adopted solution for secrets management, and its integration with Ansible Automation Platform is a common pattern for securing sensitive data in automated workflows. This incident underscores the continuous challenge of maintaining security in complex, interconnected systems, where a vulnerability in one component can have cascading effects across the entire infrastructure. It highlights the need for rigorous security audits of third-party integrations and custom plugins within automation tools. Practitioners using Red Hat Ansible Automation Platform, especially those integrating with HashiCorp Vault and Kubernetes, must immediately assess their exposure to CVE-2026-12564. The primary action is to apply any available patches or updates from Red Hat that address this vulnerability. Beyond patching, it is crucial to review existing HashiCorp Vault credential configurations, particularly those using `kubernetes_role` authentication, and ensure that the principle of least privilege is strictly enforced for users with credential-creation capabilities. Organizations should also consider implementing enhanced monitoring and alerting for unusual activity related to Kubernetes service account token usage and HashiCorp Vault interactions. Regular security audits and penetration testing focused on the automation platform's integrations are also recommended to proactively identify and mitigate similar risks.