Vulnerability · Published Jul 30, 2026 · Assigned by redhat
CVE-2026-68563Ansible-collection-redhat-leapp: ansible-collection-redhat-leapp: information disclosure of postgresql data via insecure backup permissions
Medium 5.5
In plain English
A medium-severity incorrect permission assignment in Red Hat Enterprise Linux 10 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 1% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A flaw was found in ansible-collection-redhat-leapp. When a remediation task is executed with elevated privileges and the `leapp_old_postgresql_data` option is selected, a PostgreSQL data backup archive is created with insecure permissions. This allows a local non-root user on the managed node to read sensitive archived PostgreSQL data, leading to information disclosure.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux:10 | ansible-collection-redhat-leapp | 0:1.7.4-2.el10_2 | RLSA-2026:91491 |
| Rocky Linux:9 | ansible-collection-redhat-leapp | 0:1.7.4-2.el9_8 | RLSA-2026:91490 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | see references |
| Red Hat | Red Hat Enterprise Linux 9 | see references |
Weakness: CWE-732 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
References
- RHSA-2026:91490 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:91491 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2026-68563 vdb-entry, x_refsource_REDHAT
- RHBZ#2465419 issue-tracking, x_refsource_REDHAT