{"id":"CVE-2024-6840","aliases":["EUVD-2024-48013","GHSA-64w6-7xrg-vmhg","RHSA-2024:6428"],"status":"published","title":"Automation-controller: gain access to the k8s api server via job execution with container group","description":"An improper authorization flaw exists in the Ansible Automation Controller. This flaw allows an attacker using the k8S API server to send an HTTP request with a service account token mounted via `automountServiceAccountToken: true`, resulting in privilege escalation to a service account.","severity":{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00428,"percentile":0.37341,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-285"],"published":"2024-09-12T16:35:08Z","modified":"2026-11-05T15:16:58Z","affected":[{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.4::el8","package":"python39-zipp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.19.2-1.el8ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.4::el8","package":"python39-zipp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.19.2-1.el8ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python39-zipp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.19.2-1.el8ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.4::el9","package":"python-zipp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.19.2-1.el9ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.4::el9","package":"python3-zipp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.19.2-1.el9ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.4::el9","package":"python-zipp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.19.2-1.el9ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.4::el9","package":"python3-zipp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.19.2-1.el9ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python-zipp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.19.2-1.el9ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python3-zipp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.19.2-1.el9ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"automation-controller-venv-tower","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.10-1.el8ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"automation-controller-venv-tower","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.10-1.el9ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python39-grpcio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.58.3-1.el8ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python39-grpcio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.58.3-1.el8ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python3x-grpcio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.58.3-1.el8ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python3x-grpcio-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.58.3-1.el8ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python-grpcio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.58.3-1.el9ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python-grpcio-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.58.3-1.el9ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python3-grpcio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.58.3-1.el9ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python3-grpcio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.58.3-1.el9ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python39-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.15-1.el8ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python3x-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.15-1.el8ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.15-1.el9ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.15-1.el9ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.4::el8","package":"automation-controller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.10-1.el8ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.4::el8","package":"automation-controller-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.10-1.el8ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"automation-controller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.10-1.el8ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"automation-controller-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.10-1.el8ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"automation-controller-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.10-1.el8ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"automation-controller-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.10-1.el8ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.4::el9","package":"automation-controller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.10-1.el9ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.4::el9","package":"automation-controller-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.10-1.el9ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"automation-controller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.10-1.el9ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"automation-controller-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.10-1.el9ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"automation-controller-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.10-1.el9ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"automation-controller-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.10-1.el9ap"}]}],"bundled":13}],"products":[{"vendor":"red hat","product":"red hat ansible automation platform 2.4 for rhel 8"},{"vendor":"red hat","product":"red hat ansible automation platform 2.4 for rhel 9"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2024:6428","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-6840","tags":["vdb-entry","x_refsource_REDHAT","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2298492","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-6840","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-64w6-7xrg-vmhg"},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2277035","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2277297","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2295935","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2295936","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2295937","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2295938","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2296413","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2302433","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2302434","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2302435","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2302436","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_6428.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-5569","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-5569","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-5569","tags":["advisory"]},{"url":"https://github.com/jaraco/zipp/commit/fd604bd34f0343472521a36da1fbd22e793e14fd","tags":["article"]},{"url":"https://huntr.com/bounties/be898306-11f9-46b4-b28c-f4c4aa4ffbae","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-6840","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-7246","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2303104","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-7246","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-7246","tags":["advisory"]},{"url":"https://github.com/grpc/grpc/issues/36245","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-32879","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-32879","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-32879","tags":["advisory"]},{"url":"https://github.com/python-social-auth/social-app-django/security/advisories/GHSA-2gr8-3wc7-xhj3","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-33663","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-33663","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-33663","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-38875","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-38875","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-38875","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-39329","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-39329","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-39329","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-39330","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-39330","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-39330","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-39614","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-39614","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-39614","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-41989","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-41989","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-41989","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-41990","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-41990","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-41990","tags":["advisory"]},{"url":"https://www.djangoproject.com/weblog/2024/aug/06/security-releases/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-41991","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-41991","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-41991","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-42005","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-42005","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-42005","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-6840","title":"Automation-controller: gain access to the k8s api server via job execution with container group","description":"An improper authorization flaw exists in the Ansible Automation Controller. This flaw allows an attacker using the k8S API server to send an HTTP request with a service account token mounted via `automountServiceAccountToken: true`, resulting in privilege escalation to a service account.","status":"published","published":"2024-09-12T16:35:08.921Z","modified":"2026-11-05T14:43:49.667Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-285"],"updated_at":"2026-11-05T16:36:33.176634Z"}],"euvd":[{"id":"EUVD-2024-48013","description":"An improper authorization flaw exists in the Ansible Automation Controller. This flaw allows an attacker using the k8S API server to send an HTTP request with a service account token mounted via `automountServiceAccountToken: true`, resulting in privilege escalation to a service account.","status":"published","published":"2024-09-12T16:35:08Z","modified":"2026-11-05T14:43:49Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N","level":"medium"}],"updated_at":"2026-11-05T16:59:57.067043Z"}],"ghsa":[{"id":"GHSA-64w6-7xrg-vmhg","title":"An improper authorization flaw exists in the Ansible Automation Controller. This flaw allows an...","description":"An improper authorization flaw exists in the Ansible Automation Controller. This flaw allows an attacker using the k8S API server to send an HTTP request with a service account token mounted via `automountServiceAccountToken: true`, resulting in privilege escalation to a service account.","status":"published","published":"2024-09-12T18:31:42Z","modified":"2024-09-12T18:31:48Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N","level":"medium"}],"cwes":["CWE-285"],"updated_at":"2026-11-02T14:58:15.26738Z"}],"nvd":[{"id":"CVE-2024-6840","description":"An improper authorization flaw exists in the Ansible Automation Controller. This flaw allows an attacker using the k8S API server to send an HTTP request with a service account token mounted via `automountServiceAccountToken: true`, resulting in privilege escalation to a service account.","status":"published","published":"2024-09-12T17:15:05.773Z","modified":"2026-11-05T15:16:58.773Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-285"],"updated_at":"2026-11-05T19:55:48.976368Z"}],"osv":[{"id":"RHSA-2024:6428","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update","status":"published","published":"2024-09-30T15:23:01Z","modified":"2026-10-17T10:03:51Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:14.610978Z"}]}}