VULNERABILITY INTELLIGENCE
CVE-2024-6840
CVSS score6.6 MEDIUM
EPSS probability0.43%
CISA KEVNot currently listed
Published2024-09-12
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N
Description
An improper authorization flaw exists in the Ansible Automation Controller. This flaw allows an attacker using the k8S API server to send an HTTP request with a service account token mounted via `automountServiceAccountToken: true`, resulting in privilege escalation to a service account.
Weakness classification
- secalert@redhat.com: CWE-285