CVE-2026-75884
Awx: awx: privilege escalation to openshift namespace via pod_spec_override injection in container groups
9.1 Critical
A flaw was found in AWX. The container group pod_spec_override field uses an incomplete blocklist that only restricts automountServiceAccountToken, allowing injection of initContainers, serviceAccountName overrides, and projected service account token volumes. An AAP platform administrator can exploit this to escalate privileges to OpenShift namespace-level access and exfiltrate namespace secrets.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
0.41%Unchanged since Sep 24, 2026
What each source reports
CVE List Score used
Awx: awx: privilege escalation to openshift namespace via pod_spec_override injection in container groups
A flaw was found in AWX. The container group pod_spec_override field uses an incomplete blocklist that only restricts automountServiceAccountToken, allowing injection of initContainers, serviceAccountName overrides, and projected service account token volumes. An AAP platform administrator can exploit this to escalate privileges to OpenShift namespace-level access and exfiltrate namespace secrets.
- Record
CVE-2026-75884- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-184
- Updated
- 2026-11-02
EUVDEUVD-2026-85639
A flaw was found in AWX. The container group pod_spec_override field uses an incomplete blocklist that only restricts automountServiceAccountToken, allowing injection of initContainers, serviceAccountName overrides, and projected service account token volumes. An AAP platform administrator can exploit this to escalate privileges to OpenShift namespace-level access and exfiltrate namespace secrets.
- Record
EUVD-2026-85639- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-fwqq-57j2-8r7g
A flaw was found in AWX. The container group pod_spec_override field uses an incomplete blocklist...
A flaw was found in AWX. The container group pod_spec_override field uses an incomplete blocklist that only restricts automountServiceAccountToken, allowing injection of initContainers, serviceAccountName overrides, and projected service account token volumes. An AAP platform administrator can exploit this to escalate privileges to OpenShift namespace-level access and exfiltrate namespace secrets.
- Record
GHSA-fwqq-57j2-8r7g- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-184
- Updated
- 2026-11-02
NVD
A flaw was found in AWX. The container group pod_spec_override field uses an incomplete blocklist that only restricts automountServiceAccountToken, allowing injection of initContainers, serviceAccountName overrides, and projected service account token volumes. An AAP platform administrator can exploit this to escalate privileges to OpenShift namespace-level access and exfiltrate namespace secrets.
- Record
CVE-2026-75884- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-184
- Updated
- 2026-11-05
OSVRHSA-2026:71113
Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update
- Record
RHSA-2026:71113- CVSS 3.1
- 9.9 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2026:71114
Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update
- Record
RHSA-2026:71114- CVSS 3.1
- 9.9 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2026:71115
Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update
- Record
RHSA-2026:71115- CVSS 3.1
- 9.9 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
- red hat ansible automation platform 2.4 for rhel 8
- red hat ansible automation platform 2.4 for rhel 9
- red hat ansible automation platform 2.5 for rhel 8
- red hat ansible automation platform 2.5 for rhel 9
- red hat ansible automation platform 2.6
- red hat ansible automation platform 2.6 for rhel 9
- red hat ansible automation platform 2.7
Affected packages
| Package | Affected | Fixed |
|---|---|---|
automation-controller-venv-towerRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 61 CVEs |
before 0:4.7.17-1.el9ap | 0:4.7.17-1.el9ap |
receptorRed Hat:ansible_automation_platform:2.6::el10 From an advisory covering 61 CVEs |
before 0:1.6.8-1.el10ap | 0:1.6.8-1.el10ap |
receptorRed Hat:ansible_automation_platform_developer:2.6::el9 From an advisory covering 61 CVEs |
before 0:1.6.8-1.el9ap | 0:1.6.8-1.el9ap |
receptorRed Hat:ansible_automation_platform_inside:2.6::el9 From an advisory covering 61 CVEs |
before 0:1.6.8-1.el9ap | 0:1.6.8-1.el9ap |
automation-gateway-proxy-serverRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 61 CVEs |
before 0:2.6.17-3.el9ap | 0:2.6.17-3.el9ap |
receptorRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 61 CVEs |
before 0:1.6.8-1.el9ap | 0:1.6.8-1.el9ap |
python-sqlparseRed Hat:ansible_automation_platform_developer:2.6::el10 From an advisory covering 61 CVEs |
before 0:0.6.0-1.el10ap | 0:0.6.0-1.el10ap |
python3-sqlparseRed Hat:ansible_automation_platform_developer:2.6::el10 From an advisory covering 61 CVEs |
before 0:0.6.0-1.el10ap | 0:0.6.0-1.el10ap |
python-sqlparseRed Hat:ansible_automation_platform:2.6::el10 From an advisory covering 61 CVEs |
before 0:0.6.0-1.el10ap | 0:0.6.0-1.el10ap |
python3-sqlparseRed Hat:ansible_automation_platform:2.6::el10 From an advisory covering 61 CVEs |
before 0:0.6.0-1.el10ap | 0:0.6.0-1.el10ap |
Show 30 moreShow less
| Package | Affected | Fixed |
|---|---|---|
python3.12-sqlparseRed Hat:ansible_automation_platform_developer:2.6::el9 From an advisory covering 61 CVEs |
before 0:0.6.0-1.el9ap | 0:0.6.0-1.el9ap |
python3.12-sqlparseRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 61 CVEs |
before 0:0.6.0-1.el9ap | 0:0.6.0-1.el9ap |
automation-platform-uiRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 61 CVEs |
before 0:2.6.14-1.el9ap | 0:2.6.14-1.el9ap |
automation-controllerRed Hat:ansible_automation_platform_developer:2.6::el9 From an advisory covering 61 CVEs |
before 0:4.7.17-1.el9ap | 0:4.7.17-1.el9ap |
automation-controller-cliRed Hat:ansible_automation_platform_developer:2.6::el9 From an advisory covering 61 CVEs |
before 0:4.7.17-1.el9ap | 0:4.7.17-1.el9ap |
automation-controllerRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 61 CVEs |
before 0:4.7.17-1.el9ap | 0:4.7.17-1.el9ap |
automation-controller-cliRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 61 CVEs |
before 0:4.7.17-1.el9ap | 0:4.7.17-1.el9ap |
automation-controller-serverRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 61 CVEs |
before 0:4.7.17-1.el9ap | 0:4.7.17-1.el9ap |
automation-controller-uiRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 61 CVEs |
before 0:4.7.17-1.el9ap | 0:4.7.17-1.el9ap |
python3.12-gitpythonRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 61 CVEs |
before 0:3.1.60-1.el9ap | 0:3.1.60-1.el9ap |
automation-controller-venv-towerRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 57 CVEs |
before 0:4.6.33-1.el8ap | 0:4.6.33-1.el8ap |
automation-controller-venv-towerRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 57 CVEs |
before 0:4.6.33-1.el9ap | 0:4.6.33-1.el9ap |
receptorRed Hat:ansible_automation_platform_developer:2.5::el8 From an advisory covering 57 CVEs |
before 0:1.6.8-1.el8ap | 0:1.6.8-1.el8ap |
receptorRed Hat:ansible_automation_platform_inside:2.5::el8 From an advisory covering 57 CVEs |
before 0:1.6.8-1.el8ap | 0:1.6.8-1.el8ap |
automation-gateway-proxy-serverRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 57 CVEs |
before 0:2.5.10-8.el8ap | 0:2.5.10-8.el8ap |
receptorRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 57 CVEs |
before 0:1.6.8-1.el8ap | 0:1.6.8-1.el8ap |
receptorRed Hat:ansible_automation_platform_developer:2.5::el9 From an advisory covering 57 CVEs |
before 0:1.6.8-1.el9ap | 0:1.6.8-1.el9ap |
receptorRed Hat:ansible_automation_platform_inside:2.5::el9 From an advisory covering 57 CVEs |
before 0:1.6.8-1.el9ap | 0:1.6.8-1.el9ap |
automation-gateway-proxy-serverRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 57 CVEs |
before 0:2.6.17-3.el9ap | 0:2.6.17-3.el9ap |
receptorRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 57 CVEs |
before 0:1.6.8-1.el9ap | 0:1.6.8-1.el9ap |
python3.12-sqlparseRed Hat:ansible_automation_platform_developer:2.5::el8 From an advisory covering 57 CVEs |
before 0:0.6.0-1.el8ap | 0:0.6.0-1.el8ap |
python3.12-sqlparseRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 57 CVEs |
before 0:0.6.0-1.el8ap | 0:0.6.0-1.el8ap |
python3.12-sqlparseRed Hat:ansible_automation_platform_developer:2.5::el9 From an advisory covering 57 CVEs |
before 0:0.6.0-1.el9ap | 0:0.6.0-1.el9ap |
python3.12-sqlparseRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 57 CVEs |
before 0:0.6.0-1.el9ap | 0:0.6.0-1.el9ap |
automation-gateway-serverRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 57 CVEs |
before 0:2.5.20260923-1.el8ap | 0:2.5.20260923-1.el8ap |
automation-gateway-serverRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 57 CVEs |
before 0:2.5.20260923-1.el9ap | 0:2.5.20260923-1.el9ap |
python3.12-gitpythonRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 57 CVEs |
before 0:3.1.60-1.el8ap | 0:3.1.60-1.el8ap |
python3.12-gitpythonRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 57 CVEs |
before 0:3.1.60-1.el9ap | 0:3.1.60-1.el9ap |
automation-controller-venv-towerRed Hat:ansible_automation_platform:2.4::el8 From an advisory covering 8 CVEs |
before 0:4.5.36-1.el8ap | 0:4.5.36-1.el8ap |
automation-controller-venv-towerRed Hat:ansible_automation_platform:2.4::el9 From an advisory covering 8 CVEs |
before 0:4.5.36-1.el9ap | 0:4.5.36-1.el9ap |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| facts | NVD | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-75884 is a critical vulnerability (CVSS 9.1) in Red Hat Ansible Automation Platform 2.4 For Rhel 8, published September 23, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.41%, the 35th percentile. No source names a fixed version.
References
access.redhat.com/errata/RHSA-2026:71113
Show 194 moreShow less
bugzilla.redhat.com/show_bug.cgi?id=2517893
nvd.nist.gov/vuln/detail/CVE-2026-75884
github.com/advisories/GHSA-fwqq-57j2-8r7g
docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6/whats_new-async_updates
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_71113.json
cve.org/CVERecord?id=CVE-2026-12564
go.dev/cl/814980
groups.google.com/g/golang-announce/c/94pEornpRlI
pkg.go.dev/vuln/GO-2026-5972
vulncheck.com/advisories/nanoid-before-infinite-loop-via-negative-size-in-non-secure-module
This page doesn't list everything
Left out here: 140 references. The JSON record has them.