CVE-2024-6840CWE-285

Automation-controller: gain access to the k8s api server via job execution with container group

Medium · published September 12, 2024

CVSS v3.1
6.6
EPSS
0%
Percentile
36.0
In the wild
Unconfirmed
What it is

An improper authorization flaw exists in the Ansible Automation Controller. This flaw allows an attacker using the k8S API server to send an HTTP request with a service account token mounted via `automountServiceAccountToken: true`, resulting in privilege escalation to a service account.

The record
Technical detail
CVSS v3.1
6.6 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00428 · 36.0th percentile
Weakness
CWE-285 · Improper Authorization
Published
2024-09-12T16:35Z
EPSS history
Timeline
  • 12 SEP 16:35Z
    Automation-controller: gain access to the k8s api server via job execution with container group
    cvelistv5