CVE-2026-126643
Awaiting Analysis Awaiting Analysis - Queue

AAP Gateway Operator Cleartext Secret Exposure

Publication date: 2026-11-12

Last updated on: 2026-11-12

Assigner: redhat-SADP

Description
A cleartext storage flaw was found in the AAP Gateway Operator. When reconciling an AutomationController, the operator reads the protected resource-server Secret (Secret/<aap-name>-resource-server, key controller_resource_server_secret) and copies its plaintext value into the generated AutomationController custom resource under spec.extra_settings (RESOURCE_SERVER.SECRET_KEY). Although the operator uses no_log to keep the value out of its own logs, serializing it into the custom resource exposes it to any principal able to read the AutomationController CR without permission to read the backing Kubernetes Secret, breaking the expected OpenShift RBAC separation between the two resources. The value may also propagate into Kubernetes API/etcd storage, GitOps and Argo diffs and history, rendered manifests, support bundles, and audit data. The resource-server secret is intended for trusted Gateway-to-Controller service authentication, and its disclosure may allow a user to impersonate a trusted Controller service and reach privileged service-index APIs.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-12
Last Modified
2026-11-12
Generated
2026-11-12
AI Q&A
2026-11-12
EPSS Evaluated
N/A
NVD
CVE-2026-126643
EUVD
EUVD-2026-124342

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Red Hat Red Hat Ansible Automation Platform 2 *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-312 The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a cleartext storage flaw in the AAP Gateway Operator. When reconciling an AutomationController, the operator reads a protected Kubernetes Secret containing a resource-server credential and copies its plaintext value into the AutomationController custom resource. This exposes the secret to any user who can read the custom resource, bypassing OpenShift RBAC restrictions that should separate access to Secrets and custom resources.

Detection Guidance

Check AutomationController custom resources for plaintext secrets in spec.extra_settings using kubectl get AutomationController -o yaml. Inspect Kubernetes API/etcd storage, GitOps artifacts, Argo diffs, support bundles, and audit logs for exposed resource-server secrets. Verify if the secret controller_resource_server_secret appears in AutomationController CRs.

Impact Analysis

An attacker with read access to the AutomationController custom resource but without permission to read the Kubernetes Secret could access the plaintext credential. This may allow impersonation of a trusted Controller service and potential access to privileged APIs. The exposed secret could also propagate into Kubernetes storage, GitOps tools, manifests, support bundles, and audit logs.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Exposure of service credentials may result in data breaches, requiring incident reporting and potential fines under these regulations.

Mitigation Strategies

Restrict RBAC permissions to limit read access to AutomationController custom resources to only trusted principals. Rotate the resource-server secret immediately if unauthorized access is suspected. Update the AAP Gateway Operator to a patched version once available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-126643. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...