Bug 2571730 (CVE-2026-126643)

Summary: CVE-2026-126643 aap-gateway-operator: resource-server secret exposed in plaintext in the AutomationController custom resource
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: jlanda, kshier, rbobbitt, simaishi, stcannon, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A cleartext storage flaw was found in the AAP Gateway Operator. When reconciling an AutomationController, the operator reads the protected resource-server Secret (Secret/<aap-name>-resource-server, key controller_resource_server_secret) and copies its plaintext value into the generated AutomationController custom resource under spec.extra_settings (RESOURCE_SERVER.SECRET_KEY). Although the operator uses no_log to keep the value out of its own logs, serializing it into the custom resource exposes it to any principal able to read the AutomationController CR without permission to read the backing Kubernetes Secret, breaking the expected OpenShift RBAC separation between the two resources. The value may also propagate into Kubernetes API/etcd storage, GitOps and Argo diffs and history, rendered manifests, support bundles, and audit data. The resource-server secret is intended for trusted Gateway-to-Controller service authentication, and its disclosure may allow a user to impersonate a trusted Controller service and reach privileged service-index APIs.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-11-11 14:30:10 UTC 
The AAP/Gateway operator creates or reads a protected resource-server Secret (Secret/<aap-name>-resource-server, key controller_resource_server_secret) and then copies the plaintext value into the generated AutomationController Custom Resource under spec.extra_settings as RESOURCE_SERVER.SECRET_KEY (alongside URL: <Gateway internal URL> and VALIDATE_HTTPS: false). This breaks the expected OpenShift RBAC separation between reading an AutomationController CR and reading the corresponding Kubernetes Secret: a principal with permission to read the Controller CR can recover the service credential without permission to read the Secret. The operator uses no_log to prevent the value from appearing in its logs, but then serializes the same value into the CR. The value may also propagate into Kubernetes API/etcd storage, Argo diffs and history, rendered GitOps artifacts, support bundles, audit data, and command output. Relevant operator code: roles/ansibleautomationplatform/tasks/initialize_gateway.yml, roles/ansibleautomationplatform/tasks/inject_gw_settings_in_controller.yml, roles/ansibleautomationplatform/vars/main.yml. Confirmed in build aap-operator.v2.6.0-0.1792661545; likely all AAP versions since the introduction of the gateway operator (AAP 2.5). The value is intended for trusted Gateway-to-Controller service authentication; a user who can read the Controller CR may be able to impersonate a trusted Controller service and access privileged service-index APIs. Depending on the service authorization policy, potential impact includes reading protected service-index data, creating or modifying role assignments, modifying RBAC-related resources, and escalating AAP user privileges potentially to superuser-equivalent actions.