Skip to main content

Red Hat Leapp CVE-2026-68563

| EUVDEUVD-2026-51315 MEDIUM
Incorrect Permission Assignment for Critical Resource (CWE-732)
2026-07-30 redhat GHSA-5qhg-ffgw-hh79
Information Disclosure PostgreSQL Red Hat Red Hat Enterprise Linux 10 Red Hat Enterprise Linux 9
5.5
CVSS 3.1 · Vendor: redhat
Share

Severity by source

Vendor (redhat) PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
vuln.today AI
5.5 MEDIUM

Local low-privilege access required to read archive; no integrity or availability impact; full database backup yields high confidentiality loss.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

2
Analysis Generated
Jul 30, 2026 - 21:50 vuln.today
CVE Published
Jul 30, 2026 - 21:13 cve.org
MEDIUM 5.5

DescriptionCVE.org

A flaw was found in ansible-collection-redhat-leapp. When a remediation task is executed with elevated privileges and the leapp_old_postgresql_data option is selected, a PostgreSQL data backup archive is created with insecure permissions. This allows a local non-root user on the managed node to read sensitive archived PostgreSQL data, leading to information disclosure.

AnalysisAI

Insecure file permissions in ansible-collection-redhat-leapp expose PostgreSQL backup archives to local non-root users on managed RHEL 9 and RHEL 10 nodes. When the leapp_old_postgresql_data remediation option is invoked with elevated privileges, the resulting backup archive is written with world-readable or group-readable permissions (CWE-732), allowing any local non-root user on that managed node to extract the full contents of the archived PostgreSQL data. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Gain local non-root shell on managed RHEL node
Delivery
Wait for leapp remediation with leapp_old_postgresql_data to execute
Exploit
Locate insecure PostgreSQL backup archive on filesystem
Execution
Read archive without privilege escalation
Impact
Extract sensitive PostgreSQL data
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires all of the following: (1) the `leapp_old_postgresql_data` option must be explicitly selected when executing the ansible-collection-redhat-leapp remediation task - this is not a default configuration; (2) the remediation task must be run with elevated privileges on the managed node, which triggers the archive creation; (3) the attacker must have an active low-privilege local (non-root) shell account on the same managed RHEL 9 or RHEL 10 node where the archive is written. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 3.1 base score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) accurately reflects the threat model: exploitation is strictly local, requires only low-privilege authenticated access, and produces no integrity or availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker with a low-privilege local account on a managed RHEL 9 or RHEL 10 node waits for (or is already present when) an Ansible operator runs a leapp remediation playbook with the `leapp_old_postgresql_data` option. Once the archive is created with permissive file permissions by the elevated-privilege task, the attacker reads the archive directly from the filesystem and extracts the full PostgreSQL data directory, potentially exposing application credentials, user data, and database configurations. …
Remediation The primary remediation is to apply any patch or updated version of ansible-collection-redhat-leapp released by Red Hat in response to this CVE; no exact patched version number was confirmed in the available intelligence, so consult https://access.redhat.com/security/cve/CVE-2026-68563 for the vendor-released fix version. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in PostgreSQL

View all
CVE-2025-1094 HIGH POC
8.1 Feb 13

PostgreSQL libpq functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() improperl
CVE-2024-55964 CRITICAL POC
9.8 Mar 26

An issue was discovered in Appsmith before 1.52. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
CVE-2013-1899 MEDIUM POC
6.5 Apr 04

Argument injection vulnerability in PostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9, and 9.0.x before 9.0.13 allows re
CVE-2026-20253 CRITICAL POC
9.8 Jun 10

Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
CVE-2017-7546 CRITICAL
9.8 Aug 16

PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to incorrect authentication flaw allow
CVE-2015-1352 MEDIUM POC
5.0 Mar 30

The build_tablename function in pgsql.c in the PostgreSQL (aka pgsql) extension in PHP through 5.6.7 does not validate t
CVE-2024-10553 CRITICAL POC
9.8 Mar 20

A vulnerability in the h2oai/h2o-3 REST API versions 3.46.0.4 allows unauthenticated remote attackers to execute arbitra
CVE-2019-9193 HIGH POC
7.2 Apr 01

In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pg_execute_serve
CVE-2026-40887 CRITICAL POC
9.1 Apr 14

Unauthenticated SQL injection in Vendure Shop API allows remote attackers to execute arbitrary SQL commands against the

CVE-2022-24760 CRITICAL POC
10.0 Mar 12

Parse Server is an open source http web server backend. Rated critical severity (CVSS 10.0), this vulnerability is remot
CVE-2025-56157 CRITICAL POC
9.8 Dec 18

Hard-coded default PostgreSQL credentials shipped in the docker-compose.yaml of langgenius Dify through version 1.5.1 al
CVE-2024-12909 CRITICAL POC
9.8 Mar 20

A vulnerability in the FinanceChatLlamaPack of the run-llama/llama_index repository, versions up to v0.12.3, allows for

Same weakness CWE-732 – Incorrect Permission Assignment for Critical Resource

View all
CVE-2017-9462 HIGH POC
8.8
CVE-2017-3006 HIGH POC
8.8
CVE-2017-9602 CRITICAL POC
9.8
CVE-2022-22960 HIGH POC
7.8
CVE-2021-38085 HIGH POC
7.8
CVE-2021-35449 HIGH POC
7.8
CVE-2020-11855 HIGH POC
7.8
CVE-2020-10883 HIGH POC
7.8

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2023-4966 HIGH POC
7.5

Share

CVE-2026-68563 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy