---
id: CVE-2024-6840
title: >-
  Automation-controller: gain access to the k8s api server via job execution
  with container group
summary: >-
  An improper authorization flaw exists in the Ansible Automation Controller.
  This flaw allows an attacker using the k8S API server to send an HTTP request
  with a service account token mounted via `automountServiceAccountToken: true`,
  resu…
severity: medium
cvss: 6.6
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-285
vendor: Red Hat
product: automation-controller
affected:
  - automation-controller >= 4.5.10-1 < 4.5.10-1
  - automation-controller (all versions)
  - automation-controller (all versions)
  - automation-controller (all versions)
  - automation-controller (all versions)
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2024-09-12T16:53:45.776985Z'
published: '2024-09-12'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T14:43:49.667Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2024-6840'
references:
  - url: 'https://access.redhat.com/errata/RHSA-2024:6428'
    label: 'RHSA-2024:6428'
  - url: 'https://access.redhat.com/security/cve/CVE-2024-6840'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2298492'
    label: RHBZ#2298492
tags:
  - cve.org
epss: 0.00428
epssPercentile: 0.37215
ingestedAt: '2026-11-05T21:36:00.880Z'
---

## Overview

An improper authorization flaw exists in the Ansible Automation Controller. This flaw allows an attacker using the k8S API server to send an HTTP request with a service account token mounted via `automountServiceAccountToken: true`, resulting in privilege escalation to a service account.

## Affected

- `automation-controller >= 4.5.10-1 < 4.5.10-1`
- `automation-controller (all versions)`
- `automation-controller (all versions)`
- `automation-controller (all versions)`
- `automation-controller (all versions)`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.