CVE-2026-68562

medium Red Hat
CVSS v3 Base Score
6.2
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N
Attack Characteristics
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
Required
Confidentiality
High
Integrity
None
Availability
None
Published: July 30, 2026 (38 days ago)
Last Modified: July 30, 2026
Vendor: Red Hat
Source: REDHAT

Description

A flaw was found in ansible-collection-redhat-leapp. An attacker with privileged write access to a managed node's Leapp report content can manipulate it. When an operator runs a specific remediation task, this manipulated report can cause the Ansible controller to read its own local files and copy them to the managed node. This vulnerability leads to information disclosure, potentially exposing sensitive controller-side data such as private keys or credentials.

CWE

CWE-610

Affected Products

Red Hat Enterprise Linux 10Red Hat Enterprise Linux 9

References

🔗 bugzilla.redhat.com 🔗 www.cve.org 🔗 nvd.nist.gov