A flaw was found in AWX. The container group pod_spec_override field uses an incomplete blocklist that only restricts automountServiceAccountToken,… (CVE-2026-75884)
A critical vulnerability (CVE-2026-75884) was found in AWX's container group pod_spec_override field, which uses an incomplete blocklist. This flaw allows an Automation Platform administrator to inject initContainers, override serviceAccountName, and add projected service account token volumes, leading to privilege escalation to OpenShift namespace-level access and potential exfiltration of namespace secrets.
AI Analysis
Technical Summary
The vulnerability in AWX involves the pod_spec_override field of container groups, where the blocklist intended to restrict certain Kubernetes pod specification fields is incomplete. While it restricts automountServiceAccountToken, it fails to block injection of initContainers, serviceAccountName overrides, and projected service account token volumes. This allows an Automation Platform administrator to escalate privileges within an OpenShift environment, gaining namespace-level access and the ability to exfiltrate secrets. The CVSS v3.1 score is 9.1, indicating critical severity with network attack vector, low attack complexity, high privileges required, no user interaction, and impacts on confidentiality, integrity, and availability with scope change.
Potential Impact
An attacker with Automation Platform administrator privileges can exploit this vulnerability to escalate privileges to OpenShift namespace-level access, enabling exfiltration of sensitive namespace secrets. This compromises confidentiality, integrity, and availability of the affected environment.
Mitigation Recommendations
A security update is available from Red Hat for Ansible Automation Platform 2.6 that addresses this vulnerability. Users should apply the official patch as provided in Red Hat Advisory RHSA-2026:71113. No additional mitigation steps are indicated beyond applying the update.
A flaw was found in AWX. The container group pod_spec_override field uses an incomplete blocklist that only restricts automountServiceAccountToken,… (CVE-2026-75884)
Description
A critical vulnerability (CVE-2026-75884) was found in AWX's container group pod_spec_override field, which uses an incomplete blocklist. This flaw allows an Automation Platform administrator to inject initContainers, override serviceAccountName, and add projected service account token volumes, leading to privilege escalation to OpenShift namespace-level access and potential exfiltration of namespace secrets.
CVSS v3.1
Score 9.1critical
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in AWX involves the pod_spec_override field of container groups, where the blocklist intended to restrict certain Kubernetes pod specification fields is incomplete. While it restricts automountServiceAccountToken, it fails to block injection of initContainers, serviceAccountName overrides, and projected service account token volumes. This allows an Automation Platform administrator to escalate privileges within an OpenShift environment, gaining namespace-level access and the ability to exfiltrate secrets. The CVSS v3.1 score is 9.1, indicating critical severity with network attack vector, low attack complexity, high privileges required, no user interaction, and impacts on confidentiality, integrity, and availability with scope change.
Potential Impact
An attacker with Automation Platform administrator privileges can exploit this vulnerability to escalate privileges to OpenShift namespace-level access, enabling exfiltration of sensitive namespace secrets. This compromises confidentiality, integrity, and availability of the affected environment.
Mitigation Recommendations
A security update is available from Red Hat for Ansible Automation Platform 2.6 that addresses this vulnerability. Users should apply the official patch as provided in Red Hat Advisory RHSA-2026:71113. No additional mitigation steps are indicated beyond applying the update.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-fwqq-57j2-8r7g
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-75884"]
- Database Specific Severity
- CRITICAL
- Cvss Version
- 3.1
- State
- PUBLISHED
Patch Information
Threat ID: 6ab4be21f7a7c54106eee6f4
Added to database: 09/24/2026, 06:07:29 UTC
Last enriched: 09/24/2026, 06:19:24 UTC
Last updated: 09/25/2026, 03:47:33 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.