Ansible Automation Controller: improper authorization lets a mounted service account token escalate privileges

Impact

Automation Controller fails to authorize requests properly when they arrive carrying a Kubernetes service account token mounted via automountServiceAccountToken: true. An attacker who can send an HTTP request through the Kubernetes API server with such a token escalates to that service account inside the Controller, and the CVSS vector records a scope change - the compromise crosses out of the originating security authority. On a Kubernetes-hosted AAP that runs playbooks against the fleet, that is a pod-level token turning into automation-platform access. The record does not enumerate which service accounts are reachable, so treat the blast radius as whatever the mounted accounts in that namespace can do.

Who can reach it

Attacker able to reach the Kubernetes API server with a pod-mounted service account token - in practice someone with a workload in the cluster hosting Automation Controller. Authentication (the token) is required and Red Hat rates the privilege requirement high.

What to do

Apply RHSA-2024:6428 for Ansible Automation Platform 2.4 on RHEL 8/9 and restart the Controller pods. As defence in depth, set automountServiceAccountToken: false on pods that do not need the API server and restrict which service accounts can reach the Controller.

References

Related entries

• AMD Versal Adaptive SoC - PLM runtime services address validation: The Platform Loader and Manager firmware on AMDCVE-2025-0037 · AMD Versal Adaptive SoC - PLM runtime services address validationMedium
• Ansible automation-controller: unvalidated system-job "days" value injects arguments into control-node awx-manageCVE-2026-84724 · Red Hat Ansible Automation Platform automation-controller (system-job launch, awx-manage argument vector)Medium
• HTCondor (condor_schedd, GSI/VOMS extension parsing): An authenticated user crashes the schedd by feeding it malformedCVE-2017-16816 · HTCondor (condor_schedd, GSI/VOMS extension parsing)Medium
• GlusterFS (dict_unserialize): A negative key length in a serialized dict makes the server read memory from elsewhere inCVE-2018-10911 · GlusterFS (dict_unserialize)Medium
• Ceph CephX authentication protocol: The CephX signature calculation can be bypassed, so an on-path attacker can alterCVE-2018-1129 · Ceph CephX authentication protocolMedium
• Intel Core and Xeon CPUs - INTEL-SA-00210: This one is availability, not confidentiality, and it is the mostCVE-2018-12207 · Intel Core and Xeon CPUs - INTEL-SA-00210Medium