EUVD-2026-51314
GHSA-9hgq-3p3x-rvvw
Severity by source
AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N
PR:H confirmed by privileged write access requirement; S:C reflects impact crossing from managed node to Ansible controller; no integrity or availability impact applies.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in ansible-collection-redhat-leapp. An attacker with privileged write access to a managed node's Leapp report content can manipulate it. When an operator runs a specific remediation task, this manipulated report can cause the Ansible controller to read its own local files and copy them to the managed node. This vulnerability leads to information disclosure, potentially exposing sensitive controller-side data such as private keys or credentials.
AnalysisAI
The ansible-collection-redhat-leapp package exposes Ansible controller-side sensitive files to attacker-controlled managed nodes through a manipulated Leapp upgrade report. An attacker who has already obtained privileged write access to a managed node's Leapp report can craft malicious report content that, when an operator executes a specific remediation task, causes the Ansible controller to read and copy its own local files - including private keys and credentials - to the attacker-controlled managed node. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the attacker holds privileged write access to the managed node's Leapp report content - this is a high-privilege prerequisite, not unauthenticated access. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N) captures an important nuance: despite a scope change (S:C) to the Ansible controller and high confidentiality impact (C:H) - meaning private keys and credentials can be exfiltrated - the attack requires PR:H (the attacker must already hold privileged write access to the managed node) and UI:R (an operator must actively run a specific remediation task). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has compromised a RHEL 9 managed node with privileged (root or sudo) access modifies the Leapp report file on that node to include a crafted path reference pointing to a sensitive file on the Ansible controller (such as an SSH private key or Ansible Vault credentials file). When an operator subsequently runs the Leapp remediation Ansible task against that node - a routine step during an RHEL upgrade campaign - the Ansible controller follows the manipulated reference, reads the targeted local file, and copies its contents to the managed node, where the attacker retrieves them. … |
| Remediation | Apply the vendor-provided patch for ansible-collection-redhat-leapp as documented in the Red Hat Security Advisory at https://access.redhat.com/security/cve/CVE-2026-68562; an exact fixed version was not confirmed in the available input data and must be verified via that advisory or the Red Hat Customer Portal. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Red Hat Enterprise Linux 10
View allRemote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter
HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel
HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege
HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator
Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Containe
Denial of service in Red Hat / 389 Directory Server (389-ds-base, versions since ~1.3.2/2013) allows an authenticated LD
Local-to-domain-wide root privilege escalation in SSSD's LDAP sudo provider allows an authenticated LDAP directory user
Heap buffer overflow in GStreamer's librfb (RFB/VNC client) allows a malicious VNC server to corrupt heap memory on a co
Privilege escalation via authentication bypass in libssh affects servers that enable GSSAPIKeyExchange, where the gssapi
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today