Description

An improper authorization flaw exists in the Ansible Automation Controller. This flaw allows an attacker using the k8S API server to send an HTTP request with a service account token mounted via `automountServiceAccountToken: true`, resulting in privilege escalation to a service account.

INFO

Published Date :

2024-09-12T16:35:08.921Z

Last Modified :

2025-11-20T20:56:28.081Z

Source :

redhat
AFFECTED PRODUCTS

The following products are affected by CVE-2024-6840 vulnerability.

Vendors Products
Redhat
  • Ansible Automation Platform
  • Ansible Automation Platform Developer
  • Ansible Automation Platform Inside
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2024-6840.

URL Resource
https://access.redhat.com/errata/RHSA-2024:6428 cve-icon cve-icon
https://access.redhat.com/security/cve/CVE-2024-6840 cve-icon cve-icon
https://bugzilla.redhat.com/show_bug.cgi?id=2298492 cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2024-6840 cve-icon
https://www.cve.org/CVERecord?id=CVE-2024-6840 cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact