# CVE-2026-126643: Red Hat Ansible Automation Platform cleartext storage of resource-server secret

Source: https://junglewise.ai/threats/cve-2026-126643-a-cleartext-storage-flaw-was-found-in-the-aap-gateway-operator  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-12. Updated: 2026-11-12  
License: CC BY 4.0 with a link back

CVE-2026-126643 · Severity: medium · CVSS 6.5 · Published 2026-11-12

The AAP Gateway Operator in Red Hat Ansible Automation Platform stores a sensitive inter-service authentication credential in plaintext within a Kubernetes custom resource, making it readable to users who lack direct access to the original secret. This breaks the intended security boundary and allows an attacker with limited OpenShift permissions to steal the credential and impersonate a trusted service to reach privileged APIs.

Technologies: [Red Hat Ansible Automation Platform](https://junglewise.ai/threats/technologies/ansible-automation-platform-2). Vendors: [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-126643 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-126643 being exploited in the wild.

**How severe is CVE-2026-126643?** Medium severity, with a CVSS score of 6.5, published 12 November 2026.

**Which products and versions are affected?** Red Hat Ansible Automation Platform 2.5 and later with AAP Gateway Operator.

**Is there a fix for CVE-2026-126643?** No fixed version is recorded yet. Restrict OpenShift RBAC to limit read permission on AutomationController custom resources to principals already trusted to read the corresponding Kubernetes Secrets. Rotate the resource-server secret if untrusted principals may have read the custom resource. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-126643 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-126643?** Check whether you run Red Hat Ansible Automation Platform at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Restrict OpenShift RBAC to limit read permission on AutomationController custom resources to principals already trusted to read the corresponding Kubernetes Secrets. Rotate the resource-server secret if untrusted principals may have read the custom resource.

## Technical details

A cleartext storage flaw (CWE-312) in the AAP Gateway Operator serializes the resource-server Secret into the AutomationController custom resource spec.extra_settings, exposing it to any OpenShift principal able to read the custom resource. Exploitation requires authenticated access to OpenShift with read permission on AutomationController but not the backing Secret; the credential may also leak into etcd, GitOps diffs, audit logs, and support bundles. Disclosure of the resource-server credential allows impersonation of trusted Gateway-to-Controller service authentication and access to privileged service-index APIs.

## Affected products

- Red Hat Ansible Automation Platform 2.5 and later with AAP Gateway Operator

## Timeline

- 2026-11-12: disclosed

## References

- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/security/cve/CVE-2026-126643](https://access.redhat.com/security/cve/CVE-2026-126643)

## Related threats

- [AWX WebSocket consumer incorrect authorization](https://junglewise.ai/threats/cve-2026-71367-an-incorrect-authorization-vulnerability-was-found-in-awx-s)
- [Pulpcore expression language injection in content guard](https://junglewise.ai/threats/cve-2026-123084-an-expression-language-injection-has-been-found-in-the)
- [Red Hat Ansible Automation Platform stored XSS in Hub documentation renderer](https://junglewise.ai/threats/cve-2026-109131-the-hub-collection-module-documentation-renderer-in-the-unified)
- [Ansible Operator Jinja2 template injection](https://junglewise.ai/threats/cve-2026-92982-a-flaw-was-found-in-ansible-operator-plugins-a-low-privileged)
- [Red Hat Ansible Automation Platform duplicate CVE](https://junglewise.ai/threats/cve-2026-104710-rejected-reason-duplicate-of-which-was-publicly-disclosed-and)