CVE-2024-6840: Red Hat Ansible Automation Platform 2.4 For Rhel 8

Medium severity, CVSS 6.6. EPSS: 0.4% chance of exploitation in the next 30 days.

An improper authorization flaw exists in the Ansible Automation Controller. This flaw allows an attacker using the k8S API server to send an HTTP request with a service account token mounted via `automountServiceAccountToken: true`, resulting in privilege escalation to a service account.

Affected products

• Red Hat Red Hat Ansible Automation Platform 2.4 For Rhel 8: before 0:4.5.10-1.el8ap (fixed in 0:4.5.10-1.el8ap)
• Red Hat Red Hat Ansible Automation Platform 2.4 For Rhel 9: before 0:4.5.10-1.el9ap (fixed in 0:4.5.10-1.el9ap)

Published 2024-09-12. Last modified 2026-06-17.