Description
A flaw was found in ansible-collection-redhat-leapp. When a remediation task is executed with elevated privileges and the `leapp_old_postgresql_data` option is selected, a PostgreSQL data backup archive is created with insecure permissions. This allows a local non-root user on the managed node to read sensitive archived PostgreSQL data, leading to information disclosure.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | ansible-collection-redhat-leapp | 1.7.4-2.el10_2 | RLSA-2026:91491 |
| Rocky Linux 9 | ansible-collection-redhat-leapp | 1.7.4-2.el9_8 | RLSA-2026:91490 |
Advisories 3
- WID-SEC-2026-4187 Red Hat Enterprise Linux (libXi, libXrender, ansible-collection-redhat-leapp) und Red Hat Build of Apache Camel for Quarkus: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 12, 2026
- RLSA-2026:91490 Moderate: ansible-collection-redhat-leapp security update Rocky Linux Security Advisories · Oct 30, 2026
- RLSA-2026:91491 Important: ansible-collection-redhat-leapp security update Rocky Linux Security Advisories · Oct 30, 2026
References
- RHSA-2026:91490 vendor-advisory
- RHSA-2026:91491 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-68563 vdb-entry
- RHBZ#2465419 issue-tracking