A flaw was found in the AAP Controller's HashiCorp Vault credential plugin. The kubernetes_auth() function in awx_plugins/credentials/hashivault.py reads the controller pod's Kubernetes service account token and sends it to an attacker-controlled URL when a HashiCorp Vault Secret Lookup credential with kubernetes_role authentication is tested. An authenticated attacker with credential-creation privileges can exfiltrate the service account token, gaining Kubernetes API access to the control plane namespaces with full pod CRUD and secret read permissions, including database credentials and the Django SECRET_KEY.

A flaw was found in the AAP Controller's HashiCorp Vault credential plugin. The kubernetes_auth() function in awx_plugins/credentials/hashivault.py reads the controller pod's Kubernetes service account token and sends it to an attacker-controlled URL when a HashiCorp Vault Secret Lookup credential with kubernetes_role authentication is tested. An authenticated attacker with credential-creation privileges can exfiltrate the service account token, gaining Kubernetes API access to the control plane namespaces with full pod CRUD and secret read permissions, including database credentials and the Django SECRET_KEY.

ansible-automation-platform: privilege escalation via excessive group writable /etc/passwd permissions Automation-Controller: automation-controller: Kubernetes service account token exfiltration via HashiCorp Vault credential SSRF brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function django: Django: Remote code execution via GeoDjango spatial lookups GitPython: GitPython: Arbitrary command execution due to bypass of dangerous Git option checks GitPython: GitPython: Arbitrary code execution via improper validation of clone options mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header GitPython: GitPython: Arbitrary code execution via injected newlines in Git configuration lxml: lxml-html-clean: lxml: URL bypass vulnerability in Cleaner via missing xlink:href sqlparse: sqlparse: Denial of Service via quadratic CPU consumption in SQL parsing protobufjs: protobufjs: Denial of Service via crafted .proto schema sqlparse: sqlparse: Denial of Service via inefficient SQL parsing gitpython: GitPython: Environment variable exfiltration via attacker-controlled clone URL gitpython: GitPython: Arbitrary code execution via command injection due to unguarded Git options gitpython: GitPython: Command Injection via Git option prefix abbreviation brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation postcss: PostCSS: Information disclosure via crafted sourceMappingURL aiohttp: AIOHTTP:…