Cleartext Storage Vulnerability in AAP Gateway Operator by Red Hat
CVE-2026-126643

6.5MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Ansible Automation Platform 2
Vendor
CVE Published:
12 November 2026

What is CVE-2026-126643?

A serious flaw exists within the AAP Gateway Operator that involves cleartext storage of sensitive information. When managing an AutomationController, the operator reads the protected resource-server Secret and inadvertently serializes its plaintext value into the custom resource, compromising the security model of OpenShift's RBAC. This exposure allows unauthorized access to sensitive data, potentially enabling malicious users to impersonate a trusted Controller service and gain access to privileged service-index APIs. This flaw also risks propagating sensitive information into Kubernetes API/etcd storage, GitOps processes, and various operational histories, making it vital for organizations to address this vulnerability promptly.

References

https://access.redhat.com/security/cve/CVE-2026-126643
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2571730
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

This issue was discovered by Elijah DeLee (Red Hat Inc.).
.