Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-126643— Aap-gateway-operator: resource-server secret exposed in plaintext in the automationcontroller custom resource

Quick assessment

Affected
Red Hat Red Hat Ansible Automation Platform 2
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 AAP Gateway Operator 中发现了一个明文存储漏洞。当对 AutomationController 进行协调（reconcile）时，该操作器会读取受保护的资源服务器密钥（Secret/<aap-name>-resource-server，键名为 controller_resource_server_secret），并将其明文值复制到生成的 AutomationController 自定义资源（Custom Resource）的 字段中（对应 ）。尽管该操作器使用了 配置以避免将密钥记录到自身日

CVSS 6.5 · Medium

Possible ATT&CK Techniques 1 AI

T1027 · Obfuscated Files or Information
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-126643

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Aap-gateway-operator: resource-server secret exposed in plaintext in the automationcontroller custom resource
Source: CVE Program / CVE List V5
Vulnerability Description
A cleartext storage flaw was found in the AAP Gateway Operator. When reconciling an AutomationController, the operator reads the protected resource-server Secret (Secret/<aap-name>-resource-server, key controller_resource_server_secret) and copies its plaintext value into the generated AutomationController custom resource under spec.extra_settings (RESOURCE_SERVER.SECRET_KEY). Although the operator uses no_log to keep the value out of its own logs, serializing it into the custom resource exposes it to any principal able to read the AutomationController CR without permission to read the backing Kubernetes Secret, breaking the expected OpenShift RBAC separation between the two resources. The value may also propagate into Kubernetes API/etcd storage, GitOps and Argo diffs and history, rendered manifests, support bundles, and audit data. The resource-server secret is intended for trusted Gateway-to-Controller service authentication, and its disclosure may allow a user to impersonate a trusted Controller service and reach privileged service-index APIs.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
敏感数据的明文存储
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Red Hat Red Hat Ansible Automation Platform 2 - cpe:/a:redhat:ansible_automation_platform:2
Red Hat Red Hat Ansible Automation Platform 2 - cpe:/a:redhat:ansible_automation_platform:2
Red Hat Red Hat Ansible Automation Platform 2 - cpe:/a:redhat:ansible_automation_platform:2
Red Hat Red Hat Ansible Automation Platform 2 - cpe:/a:redhat:ansible_automation_platform:2

II. Public POCs for CVE-2026-126643

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-126643

请登录查看更多情报信息。

Other References for CVE-2026-126643 (2)

Same Patch Batch · Red Hat · 2026-11-12 · 5 CVEs total

CVE-2026-126641 6.5 MEDIUM Ansible-pylibssh: accepts a changed ssh host key when host_key_auto_add is enabled
CVE-2026-126642 6.5 MEDIUM Awx: webhook credential assignment omits use_role check, exposing another user's token
CVE-2026-71367 4.3 MEDIUM Awx: websocket broadcast groups leak cross-organization job metadata
CVE-2026-126644 3.9 LOW Ansible.posix: authorized_key module follows a parent-directory symlink allowing writes ou

IV. Related Vulnerabilities

Same product: Red Hat Ansible Automation Platform 2
Same vendor: Red Hat
Same weakness: CWE-312