Skip to content
OpenAdvisories
Medium · 6.8 CVE-2026-87872 EUVD-2026-75086GHSA-72h7-pjj2-r4pr

Community.general: community.general: ocapi module_utils (ocapi_command, ocapi_info) hardcode validate_certs=false with no override, enabling tls man-in-the-middle and credential disclosure

Published Sep 9, 2026 · Updated Sep 14, 2026 · Assigned by redhat

Description

A flaw was found in the OCAPI modules (ocapi_command, ocapi_info) of the
community.general Ansible collection. The shared OCAPI request helper disables
TLS certificate validation on every request and the modules expose no parameter
to re-enable it, while sending HTTP Basic-Auth credentials to an https endpoint.
An attacker positioned on the network path between the Ansible controller and the
OCAPI-managed storage/enclosure device can present any certificate, intercept the
session, capture the credentials, and tamper with responses.

Affected products

VendorProductAffectedFixed
Red Hat Red Hat Ceph Storage 5 — —
Red Hat Red Hat Ceph Storage 9 — —
Red Hat Red Hat OpenStack Platform 17.1 — —
Red Hat Red Hat OpenStack Platform 18.0 — —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 ansible No fix yet —
Debian 13 ansible No fix yet —
Debian 12 ansible No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 ansible +1 No fix yet —
Ubuntu 26.04 LTS ansible +1 No fix yet —
Ubuntu 24.04 LTS ansible +1 No fix yet —
Ubuntu 22.04 LTS ansible-core No fix yet —
Show 5 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 22.04 LTS ansible No fix yet —
Ubuntu Pro 20.04 LTS ansible No fix yet —
Ubuntu Pro 18.04 LTS ansible No fix yet —
Ubuntu Pro 16.04 LTS ansible No fix yet —
Ubuntu Pro 14.04 LTS ansible No fix yet —

References