CVE-2026-75884

Awx: awx: privilege escalation to openshift namespace via pod_spec_override injection in container groups

State: Published
Severity: 9.1 Critical
Published: Sep 23, 2026
Updated: Sep 24, 2026
Reserved: Aug 18, 2026

Description

A flaw was found in AWX. The container group pod_spec_override field uses an incomplete blocklist that only restricts automountServiceAccountToken, allowing injection of initContainers, serviceAccountName overrides, and projected service account token volumes. An AAP platform administrator can exploit this to escalate privileges to OpenShift namespace-level access and exfiltrate namespace secrets.

Scores

CVSS	Score	Vector	Source
3.1	9.1 Critical	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H	redhat

Weaknesses

CWE-184 Incomplete List of Disallowed Inputs

Affected Products

Product	Versions
Red Hat Ansible Automation Platform 2.4 for RHEL 8Red Hat	0:4.5.36-1.el8ap and laterNot affected
Red Hat Ansible Automation Platform 2.4 for RHEL 9Red Hat	0:4.5.36-1.el9ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 8Red Hat	0:4.6.33-1.el8ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 9Red Hat	0:4.6.33-1.el9ap and laterNot affected
Red Hat Ansible Automation Platform 2.6 for RHEL 9Red Hat	0:4.7.17-1.el9ap and laterNot affected
Red Hat Ansible Automation Platform 2.6Red Hat	1789673739 and laterNot affected
Red Hat Ansible Automation Platform 2.7Red Hat	1789580684 and laterNot affected

References

RHSA-2026:71113vendor-advisory
RHSA-2026:71114vendor-advisory
RHSA-2026:71115vendor-advisory
RHSA-2026:71177vendor-advisory
RHSA-2026:71179vendor-advisory
https://access.redhat.com/security/cve/CVE-2026-75884vdb-entry
RHBZ#2517893issue-tracking

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.