THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-12564 (CRITICAL 9.6) — A flaw was found in the AAP Controller's HashiCorp Vault credential plugin. The kubernetes_auth() function in awx_plugins/credentials/hashivault.py reads the controller pod's Kubernetes service account token and sends it to an attacker-controlled URL when a HashiCorp Vault Secret

[NVD] CVE-2026-12564 (CRITICAL 9.6) — A flaw was found in the AAP Controller's HashiCorp Vault credential plugin. The kubernetes_auth() function in awx_plugins/credentials/hashivault.py reads the controller pod's Kubernetes service account token and sends it to an attacker-controlled URL when a HashiCorp Vault Secret

lownvdPublished 2026-08-18

CVE-2026-12564 CVSS: 9.6 CRITICAL Published: 2026-08-18T16:17:01.917

A flaw was found in the AAP Controller's HashiCorp Vault credential plugin. The kubernetes_auth() function in awx_plugins/credentials/hashivault.py reads the controller pod's Kubernetes service account token and sends it to an attacker-controlled URL when a HashiCorp Vault Secret Lookup credential with kubernetes_role authentica

MITRE ATT&CK techniques

CredentialsT1589.001

Indicators of compromise

CVE-2026-12564cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-12564