The vulnerability in the AAP Controller's HashiCorp Vault credential plugin involves the kubernetes_auth() function in awx_plugins/credentials/hashivault.py, which reads the controller pod's Kubernetes service account token and transmits it to an attacker-controlled URL during credential testing. This flaw enables an authenticated attacker with credential-creation privileges to exfiltrate the service account token, granting them Kubernetes API access to control plane namespaces with full pod create, read, update, delete (CRUD) and secret read permissions, including access to database credentials and the Django SECRET_KEY. The vulnerability is tracked as CVE-2026-12564 with a CVSS 3.1 score of 9.6 (critical). Red Hat has issued an official security advisory (RHSA-2026:67279) providing an update for Red Hat Ansible Automation Platform 2.7 that addresses this issue.

An attacker with authenticated credential-creation privileges can exfiltrate the Kubernetes service account token from the controller pod, allowing full access to Kubernetes API operations in control plane namespaces. This includes the ability to create, read, update, and delete pods and read secrets, exposing sensitive information such as database credentials and the Django SECRET_KEY. The impact is critical due to the high level of access and sensitive data exposure.

Red Hat has released an official fix for this vulnerability in Red Hat Ansible Automation Platform 2.7. Users should apply the update as described in the Red Hat advisory RHSA-2026:67279. Ensure all previously released errata relevant to your system are applied before updating. No additional mitigation steps are indicated by the vendor advisory.