{"id":"CVE-2019-3869","details":"When running Tower before 3.4.3 on OpenShift or Kubernetes, application credentials are exposed to playbook job runs via environment variables. A malicious user with the ability to write playbooks could use this to gain administrative privileges.","modified":"2026-03-15T22:28:32.084152Z","published":"2019-03-28T14:29:00.307Z","references":[{"type":"FIX","url":"https://github.com/ansible/awx/pull/3505"},{"type":"FIX","url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3869"}],"affected":[{"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-3869.json","unresolved_ranges":[{"events":[{"introduced":"0"},{"fixed":"3.3.5"}]},{"events":[{"introduced":"3.4.0"},{"fixed":"3.4.3"}]},{"events":[{"introduced":"0"},{"fixed":"3.4.3"}]}]}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"}]}