cyfenced.com →

[ CVE-2026-75884 · Published 23 Sep 2026 ]

Vulnerability in Red Hat Ansible Automation Platform 2.4 for RHEL 8

CVSS 9.1 EPSS <1%1 agency advisoryNo fix listed yet

[ Why it matters ]Priority signals

  • Critical severity: CVSS 9.1

[ Description ]Official description

A flaw was found in AWX. The container group pod_spec_override field uses an incomplete blocklist that only restricts automountServiceAccountToken, allowing injection of initContainers, serviceAccountName overrides, and projected service account token volumes. An AAP platform administrator can exploit this to escalate privileges to OpenShift namespace-level access and exfiltrate namespace secrets.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

[ References ]References