Red Hat Leapp EUVD-2026-51315

Exploitation requires all of the following: (1) the leapp_old_postgresql_data option must be explicitly selected when executing the ansible-collection-redhat-leapp remediation task - this is not a default configuration; (2) the remediation task must be run with elevated privileges on the managed node, which triggers the archive creation; (3) the attacker must have an active low-privilege local (non-root) shell account on the same managed RHEL 9 or RHEL 10 node where the archive is written. Remote exploitation is not possible - the CVSS vector is AV:L. Exploitation is limited to the time window during which the insecurely-permissioned archive exists on disk. Environments without local multi-user access, or that do not use the leapp_old_postgresql_data option, are not exposed.

The CVSS 3.1 base score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) accurately reflects the threat model: exploitation is strictly local, requires only low-privilege authenticated access, and produces no integrity or availability impact. EPSS data is not available in the provided intelligence, and the vulnerability is not listed in CISA KEV, indicating no confirmed active exploitation at the time of analysis. No public proof-of-concept code has been identified. Despite the moderate CVSS score, the confidentiality impact is rated High because a full PostgreSQL data backup can expose database schemas, application credentials, and sensitive records. The practical risk is constrained by the need for both local user access on the managed node AND the specific leapp_old_postgresql_data option being used during a remediation run - environments that do not use this option or that tightly control local user access have significantly reduced exposure. This is a real but narrowly scoped issue, not a broad Internet-facing threat.

An attacker with a low-privilege local account on a managed RHEL 9 or RHEL 10 node waits for (or is already present when) an Ansible operator runs a leapp remediation playbook with the leapp_old_postgresql_data option. Once the archive is created with permissive file permissions by the elevated-privilege task, the attacker reads the archive directly from the filesystem and extracts the full PostgreSQL data directory, potentially exposing application credentials, user data, and database configurations. No public proof-of-concept code has been identified, but the attack requires no special tooling beyond standard Linux file-reading commands.