Vulnerability · Published Jul 30, 2026 · Assigned by redhat
CVE-2026-68562Ansible-collection-redhat-leapp: ansible-collection-redhat-leapp: information disclosure via leapp report tampering
Medium 6.2
In plain English
A medium-severity security flaw in Red Hat Enterprise Linux 10 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A flaw was found in ansible-collection-redhat-leapp. An attacker with privileged write access to a managed node's Leapp report content can manipulate it. When an operator runs a specific remediation task, this manipulated report can cause the Ansible controller to read its own local files and copy them to the managed node. This vulnerability leads to information disclosure, potentially exposing sensitive controller-side data such as private keys or credentials.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux:10 | ansible-collection-redhat-leapp | 0:1.7.4-2.el10_2 | RLSA-2026:91491 |
| Rocky Linux:9 | ansible-collection-redhat-leapp | 0:1.7.4-2.el9_8 | RLSA-2026:91490 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | see references |
| Red Hat | Red Hat Enterprise Linux 9 | see references |
Weakness: CWE-610 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N
References
- RHSA-2026:91490 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:91491 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2026-68562 vdb-entry, x_refsource_REDHAT
- RHBZ#2466035 issue-tracking, x_refsource_REDHAT