Description
A flaw was found in ansible-collection-redhat-leapp. An attacker with privileged write access to a managed node's Leapp report content can manipulate it. When an operator runs a specific remediation task, this manipulated report can cause the Ansible controller to read its own local files and copy them to the managed node. This vulnerability leads to information disclosure, potentially exposing sensitive controller-side data such as private keys or credentials.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | ansible-collection-redhat-leapp | 1.7.4-2.el10_2 | RLSA-2026:91491 |
| Rocky Linux 9 | ansible-collection-redhat-leapp | 1.7.4-2.el9_8 | RLSA-2026:91490 |
Advisories 3
- WID-SEC-2026-4187 Red Hat Enterprise Linux (libXi, libXrender, ansible-collection-redhat-leapp) und Red Hat Build of Apache Camel for Quarkus: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 12, 2026
- RLSA-2026:91490 Moderate: ansible-collection-redhat-leapp security update Rocky Linux Security Advisories · Oct 30, 2026
- RLSA-2026:91491 Important: ansible-collection-redhat-leapp security update Rocky Linux Security Advisories · Oct 30, 2026
References
- RHSA-2026:91490 vendor-advisory
- RHSA-2026:91491 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-68562 vdb-entry
- RHBZ#2466035 issue-tracking