EUVD-2026-51314
GHSA-9hgq-3p3x-rvvw
Severity by source
AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N
PR:H confirmed by privileged write access requirement; S:C reflects impact crossing from managed node to Ansible controller; no integrity or availability impact applies.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in ansible-collection-redhat-leapp. An attacker with privileged write access to a managed node's Leapp report content can manipulate it. When an operator runs a specific remediation task, this manipulated report can cause the Ansible controller to read its own local files and copy them to the managed node. This vulnerability leads to information disclosure, potentially exposing sensitive controller-side data such as private keys or credentials.
AnalysisAI
The ansible-collection-redhat-leapp package exposes Ansible controller-side sensitive files to attacker-controlled managed nodes through a manipulated Leapp upgrade report. An attacker who has already obtained privileged write access to a managed node's Leapp report can craft malicious report content that, when an operator executes a specific remediation task, causes the Ansible controller to read and copy its own local files - including private keys and credentials - to the attacker-controlled managed node. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; however, the CVSS 3.1 score of 6.2 reflects real-world risk limited by the high privilege prerequisite and required operator interaction.
Technical ContextAI
The Leapp framework is Red Hat's toolchain for performing in-place major-version upgrades of Red Hat Enterprise Linux (e.g., RHEL 8 to RHEL 9, or RHEL 9 to RHEL 10). The ansible-collection-redhat-leapp Ansible collection orchestrates Leapp upgrade tasks from an Ansible controller against managed nodes. During a Leapp upgrade workflow, the controller processes a 'Leapp report' generated on the managed node, which contains remediation entries and upgrade inhibitors. The root cause is CWE-610 (Externally Controlled Reference to a Resource in Another Sphere): the Ansible collection consumes attacker-influenced report data from the managed node and uses it to construct file-read operations on the controller itself without adequate sanitization or validation, effectively allowing the managed node's report content to redirect what local files the controller accesses. Affected CPEs are cpe:2.3:a:red_hat:red_hat_enterprise_linux_9 and cpe:2.3:a:red_hat:red_hat_enterprise_linux_10.
RemediationAI
Apply the vendor-provided patch for ansible-collection-redhat-leapp as documented in the Red Hat Security Advisory at https://access.redhat.com/security/cve/CVE-2026-68562; an exact fixed version was not confirmed in the available input data and must be verified via that advisory or the Red Hat Customer Portal. As a compensating control until patching is possible, restrict operator execution of Leapp remediation tasks to only verified, trusted managed nodes and validate Leapp report integrity before task execution. Additionally, harden the Ansible controller's file system by ensuring the user account running the Ansible process has read access limited to only the directories required for operation - this would constrain which sensitive files could be exfiltrated even if the vulnerability is triggered. Review and audit the managed nodes' Leapp report directories for unexpected or unauthorized modifications before running any remediation tasks.
More in Red Hat Enterprise Linux 10
View allHeap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter
Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe
HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel
HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege
HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator
Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Containe
Same technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today