CVE-2026-68563

MediumCVSS 5.5

Published: 30/07/2026(UTC)Updated: 29/10/2026(UTC)Translated: 31/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.11%

1th percentile - higher than 1% of all known CVEs

Summary

In the ansible-collection-redhat-leapp, when a remediation task is executed with elevated privileges and the `leapp_old_postgresql_data` option is selected, a PostgreSQL backup archive is created with insecure permissions. A local non-root user on the managed node can read sensitive archived data.

Risk Assessment

The organization risks exposure of confidential PostgreSQL data, such as customer information or configurations, potentially leading to privacy breaches and regulatory non-compliance.

Recommendation

Update the ansible-collection-redhat-leapp to the latest version that fixes the insecure archive permissions.

Other vulnerabilities in ansible-collection-redhat-leapp

CVE-2026-68562Medium
In the ansible-collection-redhat-leapp, an attacker with write access to a managed node can manipulate the Leapp report content. When an operator runs a specific remediation task, the manipulated report causes the Ansible controller to read its own local files and copy them to the managed node, leading to disclosure of sensitive data like private keys or credentials.

Original NVD description (English source)

A flaw was found in ansible-collection-redhat-leapp. When a remediation task is executed with elevated privileges and the `leapp_old_postgresql_data` option is selected, a PostgreSQL data backup archive is created with insecure permissions. This allows a local non-root user on the managed node to read sensitive archived PostgreSQL data, leading to information disclosure.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS