CVE-2026-68562
mediumA flaw was found in ansible-collection-redhat-leapp.
A flaw was found in ansible-collection-redhat-leapp. An attacker with privileged write access to a managed node's Leapp report content can manipulate it. When an operator runs a specific remediation task, this manipulated report can cause the Ansible controller to read its own local files and copy them to the managed node. This vulnerability leads to information disclosure, potentially exposing sensitive controller-side data such as private keys or credentials.
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://access.redhat.com/errata/RHSA-2026:91490 secalert@redhat.com
- https://access.redhat.com/errata/RHSA-2026:91491 secalert@redhat.com
- https://access.redhat.com/security/cve/CVE-2026-68562 secalert@redhat.com
- https://bugzilla.redhat.com/show_bug.cgi?id=2466035 secalert@redhat.com