CVE-2026-75884

Summary

The flaw in AWX allows an attacker to inject initContainers, serviceAccountName overrides, and projected service account token volumes, leading to privilege escalation and potential exfiltration of namespace secrets.

Exploitability

Exploitation requires access to the affected AWX instance and the ability to modify pod_spec_override, making it moderately difficult.

Blast radius

If exploited, this can result in unauthorized access to OpenShift namespace secrets, potentially leading to data exfiltration and broader system compromise.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to the latest version of AWX, ensuring all security patches are applied.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.