Critical Flaw in AAP Controller's HashiCorp Vault Plugin
- Severity
- CRITICAL
- CVSS
- 9.6
- Affected component
- hashivault (pypi)
- Patched version
- Not yet available
An early warning has been issued regarding a critical flaw in the AAP Controller's HashiCorp Vault credential plugin. This flaw allows an authenticated attacker with credential-creation privileges to potentially exfiltrate sensitive information.
What happened
An early warning has been issued for a critical flaw identified in the AAP Controller's HashiCorp Vault credential plugin, tracked as CVE-2026-12564. This flaw, which has a CVSS score of 9.6, allows an authenticated attacker with credential-creation privileges to exfiltrate the service account token. This can lead to unauthorized access to the Kubernetes API, granting full pod CRUD and secret read permissions, including sensitive data such as database credentials and the Django SECRET_KEY.
The vulnerability is located in the kubernetes_auth() function within the awx_plugins/credentials/hashivault.py file. When a HashiCorp Vault Secret Lookup credential with kubernetes_role authentication is tested, the function reads the controller pod's Kubernetes service account token and sends it to an attacker-controlled URL. This behavior enables the attacker to gain unauthorized access to critical resources.
What to do about it
- Monitor the primary sources for updates on the vulnerability.
- Upgrade to a patched version of hashivault as soon as it becomes available.
- Rotate any affected service account tokens and secrets to mitigate potential damage.
- Review your current credential-creation privileges to ensure they are appropriately restricted.
- Implement additional monitoring for any unusual activity related to Kubernetes API access.
How 0Day would have caught this
hashivault is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
If you are using the AAP Controller's HashiCorp Vault credential plugin, you may be affected. Consult the primary sources for more detailed information.
What should I do right now?
Monitor the primary sources for updates, upgrade to a patched version of hashivault when available, and rotate any affected service account tokens and secrets.
Is there an official fix available yet?
No official fix has been published yet. Monitor the primary sources for updates on patched versions.
How severe is this vulnerability?
This vulnerability is rated as CRITICAL with a CVSS score of 9.6.