CVE-2026-75884

Awaiting Analysis Awaiting Analysis - Queue

Privilege Escalation in AWX via Pod Spec Override

Publication date: 2026-09-23

Last updated on: 2026-09-24

Assigner: redhat-SADP

Description

A flaw was found in AWX. The container group pod_spec_override field uses an incomplete blocklist that only restricts automountServiceAccountToken, allowing injection of initContainers, serviceAccountName overrides, and projected service account token volumes. An AAP platform administrator can exploit this to escalate privileges to OpenShift namespace-level access and exfiltrate namespace secrets.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-23

Last Modified

2026-09-24

Generated

2026-10-14

AI Q&A

2026-09-24

EPSS Evaluated

2026-10-12

NVD

CVE-2026-75884

EUVD

EUVD-2026-85639

Affected Vendors & Products

Vendor	Product	Version / Range
redhat	awx	*
red_hat	ansible_automation_platform	From 2.4\|end_including=2.4 (inc)
red_hat	ansible_automation_platform	From 2.5\|end_including=2.5 (inc)
red_hat	ansible_automation_platform	From 2.6\|end_including=2.6 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-184	The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.

Attack-Flow Graph

Executive Summary

This vulnerability in AWX allows an administrator to inject malicious container configurations through the pod_spec_override field. The incomplete blocklist only restricts automountServiceAccountToken, enabling attackers to add initContainers, override serviceAccountName, or inject projected service account tokens. This leads to privilege escalation within the OpenShift namespace and potential exfiltration of sensitive secrets.

Detection Guidance

Check AWX container group configurations for pod_spec_override fields containing initContainers, serviceAccountName, or projected service account token volumes. Review OpenShift audit logs for unauthorized privilege escalation attempts or secret exfiltration activities.

Impact Analysis

An attacker with administrator access could escalate privileges to gain OpenShift namespace-level access. This allows them to steal namespace secrets, including admin passwords and database encryption keys. Containerized installations using Podman are not affected.

Compliance Impact

This vulnerability allows privilege escalation to OpenShift namespace-level access and exfiltration of namespace secrets, including sensitive data like admin passwords and encryption keys. Such unauthorized access could lead to violations of data protection regulations like GDPR (General Data Protection Regulation) and HIPAA (Health Insurance Portability and Accountability Act) by exposing personal or health information.

Mitigation Strategies

Apply the latest security updates for Red Hat Ansible Automation Platform versions 2.4, 2.5, or 2.6 as provided in RHSA-2026:71115, RHSA-2026:71114, or RHSA-2026:71113 respectively.
Audit and remove any unauthorized initContainers, serviceAccountName overrides, or projected service account token volumes in pod_spec_override configurations.
Monitor OpenShift namespace for unusual access patterns or secret exfiltration attempts.

Hi! I’m here to help you understand CVE-2026-75884. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70