CVE-2024-6840

6.6 mediumEPSS 0.4%

Medium (6.6). EPSS 0.4% chance of exploitation in the next 30 days.

An improper authorization flaw exists in the Ansible Automation Controller. This flaw allows an attacker using the k8S API server to send an HTTP request with a service account token mounted via `automountServiceAccountToken: true`, resulting in privilege escalation to a service account.

Severity

CVSS 3.1

6.6 medium

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 37% of CVEs (scores of 2026-10-31)
CWE: CWE-285
Published: 2024-09-12
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

https://access.redhat.com/errata/RHSA-2024:6428
https://access.redhat.com/security/cve/CVE-2024-6840
https://bugzilla.redhat.com/show_bug.cgi?id=2298492

Check your stack JSON