CVE-2024-6840: medium-severity vulnerability in automation-controller
Automation-controller: gain access to the k8s api server via job execution with container group
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.6epss 0.4%
An improper authorization flaw exists in the Ansible Automation Controller. This flaw allows an attacker using the k8S API server to send an HTTP request with a service account token mounted via `automountServiceAccountToken: true`, resulting in privilege escalation to a service account.
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N
Affected products
automation-controllerRed Hat · Red Hat Ansible Automation Platform 2.4 for RHEL 8Red Hat · Red Hat Ansible Automation Platform 2.4 for RHEL 9Related CVEs — automation-controller
In the same product, most dangerous first.
CVE-2024-1394HIGHGolang-fips/openssl: memory leaks in code encrypting and decrypting rsa payloadsEPSS 1.5%CVE-2023-5115MEDIUMAnsible: malicious role archive can cause ansible-galaxy to overwrite arbitrary filesEPSS 1.0%CVE-2023-5189MEDIUMHub: insecure galaxy-importer tarfile extractionEPSS 1.0%CVE-2023-3971HIGHController: html injection in custom login infoEPSS 0.8%CVE-2026-84474CRITICALAutomation-controller: automation-controller-container: automation-controller: view_jobtemplate to execute privilege escalation via host_config_key exposure and x-forwarded-for spoofing of provisioning-callback host matchEPSS 0.8%CVE-2023-4380MEDIUMPlatform: token exposed at importing projectEPSS 0.6%