{"id":"CVE-2026-75884","published":"2026-09-23T20:17:14.637","lastModified":"2026-09-24T16:17:10.120","description":"A flaw was found in AWX. The container group pod_spec_override field uses an incomplete blocklist that only restricts automountServiceAccountToken, allowing injection of initContainers, serviceAccountName overrides, and projected service account token volumes. An AAP platform administrator can exploit this to escalate privileges to OpenShift namespace-level access and exfiltrate namespace secrets.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-184"],"vendors":[],"products":[],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:71113","tags":[]},{"url":"https://access.redhat.com/errata/RHSA-2026:71114","tags":[]},{"url":"https://access.redhat.com/errata/RHSA-2026:71115","tags":[]},{"url":"https://access.redhat.com/errata/RHSA-2026:71177","tags":[]},{"url":"https://access.redhat.com/errata/RHSA-2026:71179","tags":[]},{"url":"https://access.redhat.com/security/cve/CVE-2026-75884","tags":[]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2517893","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The flaw in AWX allows an attacker to inject initContainers, serviceAccountName overrides, and projected service account token volumes, leading to privilege escalation and potential exfiltration of namespace secrets.","exploitability":"Exploitation requires access to the affected AWX instance and the ability to modify pod_spec_override, making it moderately difficult.","blast_radius":"If exploited, this can result in unauthorized access to OpenShift namespace secrets, potentially leading to data exfiltration and broader system compromise.","remediation":"Upgrade to the latest version of AWX, ensuring all security patches are applied.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["privilege-escalation","secrets-exfiltration","container-security"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-09-28T08:52:21.498Z"}}