The vulnerability in Red Hat Ansible Automation Platform 2's AWX controller arises from an incomplete input validation in the container group pod_spec_override field. The blocklist restricts only automountServiceAccountToken, permitting injection of other potentially dangerous inputs such as initContainers, serviceAccountName overrides, and projected service account token volumes. This allows an AAP platform administrator to escalate privileges from the application level to OpenShift namespace-level access, enabling exfiltration of namespace secrets including admin passwords and database field-encryption keys. Containerized (Podman) installations are not affected. Red Hat has published an advisory but currently does not offer a fix or mitigation that meets their criteria for ease of use, applicability, and stability.

An attacker with AAP platform administrator privileges can exploit this vulnerability to escalate privileges to the OpenShift namespace level. This escalation enables access to sensitive namespace secrets such as administrative passwords and database encryption keys, potentially compromising confidentiality, integrity, and availability at a high level within the affected environment.

Red Hat currently does not provide an official fix or mitigation that meets their criteria for ease of use, deployment, applicability, or stability. Containerized (Podman) installations are not affected by this vulnerability. Users should monitor Red Hat's advisory for updates and consider architectural or administrative controls to limit exposure until a fix is available.