community.general Ansible CVE-2026-87872

Exploitation requires all three of the following conditions: (1) the target environment must actively use the community.general ocapi_command or ocapi_info Ansible modules to manage OCAPI-capable storage or enclosure hardware - environments not using these specific modules are unaffected; (2) the attacker must be positioned on the adjacent network segment between the Ansible controller and the OCAPI device, such as the same management VLAN or a connected switch, since the CVSS AV:A constraint excludes remote internet-based attackers without prior network foothold; (3) the attacker must be capable of sustaining active MITM interception (AC:H), such as via ARP poisoning, rogue DHCP, or a compromised network device. There is no configuration option in the affected modules that would prevent exploitation - certificate validation is unconditionally disabled regardless of any other security posture. Exploitation is limited by the AC:H requirement and the specialized OCAPI deployment context.

The CVSS 3.1 vector AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N accurately reflects the constraints: the attacker must already occupy an adjacent network position (AV:A) and maintain active MITM capability (AC:H), which is a meaningful practical barrier in well-segmented data center environments. Once positioned, however, no privileges are required and exploitation is silent - the Ansible controller will continue operating normally while credentials are captured. The high integrity impact (I:H) is a frequently overlooked risk: beyond credential theft, a MITM can return falsified device state to the Ansible controller, causing playbooks to act on incorrect storage topology data. EPSS data is absent from the available intelligence, and the vulnerability is not in CISA KEV, indicating no confirmed opportunistic exploitation. Environments running Ansible automation against OCAPI-managed HPE infrastructure over shared or insufficiently isolated management networks - even in smaller deployments - face meaningful credential exposure risk if network segmentation is not enforced between the Ansible controller and storage management interfaces. The AC:H constraint and specialized deployment context together make widespread opportunistic exploitation unlikely, but the impact in targeted attacks against data center automation pipelines is significant.

An attacker with access to the data center management VLAN uses ARP spoofing to intercept traffic between the Ansible controller and an OCAPI-managed storage enclosure, then presents a self-signed certificate that the ocapi_command module accepts without error due to disabled validation. The attacker captures the HTTP Basic-Auth credentials from the Authorization header and returns crafted OCAPI responses, causing the Ansible playbook to record false device state. No public exploit code has been identified, but the technique requires only standard MITM tooling available in any penetration testing toolkit.