What is the CVSS score of CVE-2026-68563?

CVE-2026-68563 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Red Hat Leapp CVE-2026-68563

EUVD-2026-51315 MEDIUM

Incorrect Permission Assignment for Critical Resource (CWE-732)

2026-07-30 redhat

GHSA-5qhg-ffgw-hh79

Information Disclosure PostgreSQL Red Hat Red Hat Enterprise Linux 10 Red Hat Enterprise Linux 9 Red Hat

5.5

CVSS 3.1 · Vendor: redhat

Severity by source

Vendor (redhat) PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

5.5 MEDIUM

Local low-privilege access required to read archive; no integrity or availability impact; full database backup yields high confidentiality loss.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Red Hat

5.5 MEDIUM

qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 21:50 vuln.today

CVE Published

Jul 30, 2026 - 21:13 cve.org

MEDIUM 5.5

DescriptionCVE.org

A flaw was found in ansible-collection-redhat-leapp. When a remediation task is executed with elevated privileges and the leapp_old_postgresql_data option is selected, a PostgreSQL data backup archive is created with insecure permissions. This allows a local non-root user on the managed node to read sensitive archived PostgreSQL data, leading to information disclosure.

AnalysisAI

Insecure file permissions in ansible-collection-redhat-leapp expose PostgreSQL backup archives to local non-root users on managed RHEL 9 and RHEL 10 nodes. When the leapp_old_postgresql_data remediation option is invoked with elevated privileges, the resulting backup archive is written with world-readable or group-readable permissions (CWE-732), allowing any local non-root user on that managed node to extract the full contents of the archived PostgreSQL data. No public exploit has been identified at time of analysis, and exploitation requires local authenticated access to the managed node.

Technical ContextAI

ansible-collection-redhat-leapp is a Red Hat-maintained Ansible collection that automates in-place OS upgrade remediation tasks on RHEL systems (CPE: cpe:2.3:a:red_hat:red_hat_enterprise_linux_9 and cpe:2.3:a:red_hat:red_hat_enterprise_linux_10). The vulnerability is rooted in CWE-732 (Incorrect Permission Assignment for Critical Resource): the Ansible remediation role creates a PostgreSQL data backup archive without applying restrictive file permissions (e.g., 0600 or 0640), meaning the archive is accessible beyond the intended privileged owner. PostgreSQL data directories routinely contain authentication credentials, application data, and configuration secrets, making this a high-confidentiality-impact disclosure even though the attack vector is local. The flaw is triggered specifically by the leapp_old_postgresql_data option within the remediation playbook.

RemediationAI

The primary remediation is to apply any patch or updated version of ansible-collection-redhat-leapp released by Red Hat in response to this CVE; no exact patched version number was confirmed in the available intelligence, so consult https://access.redhat.com/security/cve/CVE-2026-68563 for the vendor-released fix version. As an immediate workaround, administrators should avoid using the leapp_old_postgresql_data option unless strictly necessary, thereby preventing creation of the insecurely-permissioned archive entirely. If the backup is required, a post-task remediation step can explicitly restrict archive permissions using chmod 600 on the resulting archive file immediately after creation, though this window of exposure between creation and permission change must be accounted for. Additionally, restricting local shell access on managed nodes to only trusted accounts limits the practical exploitability of the flaw without requiring application changes.