CVE-2026-68562 Ansible-collection-redhat-leapp: ansible-collection-redhat-leapp: information disclosure via leapp report tampering
An attacker with write access to Leapp reports can trick Ansible into copying sensitive controller files to managed nodes, exposing private keys.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-68562?
CVE-2026-68562 is a medium-severity vulnerability in Red Hat Enterprise Linux 10, published on 30 Jul 2026. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
A flaw was found in ansible-collection-redhat-leapp. An attacker with privileged write access to a managed node's Leapp report content can manipulate it. When an operator runs a specific remediation task, this manipulated report can cause the Ansible controller to read its own local files and copy them to the managed node. This vulnerability leads to information disclosure, potentially exposing sensitive controller-side data such as private keys or credentials.
Weakness: CWE-610
Which versions are affected by CVE-2026-68562?
How do I fix CVE-2026-68562?
Apply the vendor's patch.
Is CVE-2026-68562 being exploited?
There is no known exploitation of CVE-2026-68562 in the wild and no public exploit code.
Sources
Also known as GHSA-9hgq-3p3x-rvvw.