CVE-2026-126643: Aap-gateway-operator: resource-server secret exposed in plaintext in the automationcontroller custom resource
A cleartext storage flaw was found in the AAP Gateway Operator. When reconciling an AutomationController, the operator reads the protected resource-server Secret (Secret/<aap-name>-resource-server, key controllerresourceserversecret) and copies its plaintext value into the generated AutomationController custom resource under spec.extrasettings (RESOURCESERVER.SECRETKEY). Although the operator uses nolog to keep the value out of its own logs, serializing it into the custom resource exposes it to any principal able to read the AutomationController CR without permission to read the backing Kubernetes Secret, breaking the expected OpenShift RBAC separation between the two resources. The value may also propagate into Kubernetes API/etcd storage, GitOps and Argo diffs and history, rendered manifests, support bundles, and audit data. The resource-server secret is intended for trusted Gateway-to-Controller service authentication, and its disclosure may allow a user to impersonate a trusted Controller service and reach privileged service-index APIs.
Other sources
The AAP/Gateway operator creates or reads a protected resource-server Secret (Secret/<aap-name>-resource-server, key controllerresourceserversecret) and then copies the plaintext value into the generated AutomationController Custom Resource under spec.extrasettings as RESOURCESERVER.SECRETKEY (alongside URL: <Gateway internal URL> and VALIDATEHTTPS: false). This breaks the expected OpenShift RBAC separation between reading an AutomationController CR and reading the corresponding Kubernetes Secret: a principal with permission to read the Controller CR can recover the service credential without permission to read the Secret. The operator uses nolog to prevent the value from appearing in its logs, but then serializes the same value into the CR. The value may also propagate into Kubernetes API/etcd storage, Argo diffs and history, rendered GitOps artifacts, support bundles, audit data, and command output. Relevant operator code: roles/ansibleautomationplatform/tasks/initializegateway.yml, roles/ansibleautomationplatform/tasks/injectgwsettingsincontroller.yml, roles/ansibleautomationplatform/vars/main.yml. Confirmed in build aap-operator.v2.6.0-0.1792661545; likely all AAP versions since the introduction of the gateway operator (AAP 2.5). The value is intended for trusted Gateway-to-Controller service authentication; a user who can read the Controller CR may be able to impersonate a trusted Controller service and access privileged service-index APIs. Depending on the service authorization policy, potential impact includes reading protected service-index data, creating or modifying role assignments, modifying RBAC-related resources, and escalating AAP user privileges potentially to superuser-equivalent actions.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
Which users can access the sensitive value without Secret permissions?
Any principal that can read the AutomationController custom resource may see the value, even if it is not permitted to read the backing Kubernetes Secret. This bypasses the intended RBAC separation between the custom resource and Secret.
What access would an attacker need to exploit this?
The attacker needs read access to the affected AutomationController custom resource. They do not need permission to read Secret/<aap-name>-resource-server or its controller_resource_server_secret key.
How can I check whether the value was exposed?
Inspect generated AutomationController custom resources for spec.extra_settings containing RESOURCE_SERVER.SECRET_KEY. Also review GitOps or Argo diffs and history, rendered manifests, support bundles, audit data, and Kubernetes API or etcd storage that may have retained the serialized value.
What could disclosure of this value enable?
The resource-server secret is intended for trusted Gateway-to-Controller service authentication. Its disclosure may allow a user to impersonate a trusted Controller service and reach privileged service-index APIs.