CVE-2026-68562
A flaw was found in ansible-collection-redhat-leapp. An attacker with privileged write access to a managed node's Leapp report content can manipulate it. When an operator runs a specific remediation task, this manipulated report can cause the Ansible controller to read its own local files and copy them to the managed node. This vulnerability leads to information disclosure, potentially exposing sensitive controller-side data such as private keys or credentials.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 6.2
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N
- EPSS probability
- 0.22%
- CWE
- CWE-610
- Published
- 2026-07-30
- Last modified
- 2026-07-31
Weakness type
Related vulnerabilities
- CVE-2026-19032 — jackson-databind resolves attacker-controlled URI schemes when deserializing java.nio.file.Path
- CVE-2026-21810 — HCL BigFix Quantum Risk Analyzer is affected by a hardcoded external resource reference and downloading code without integrity checking
- CVE-2026-79256 — Externally controlled reference in WebView in Google Chrome on on Android prior to 152.0.7977.65...
- CVE-2026-78966 — Externally controlled reference in QUIC in Google Chrome prior to 152.0.7977.65 allowed a remote...
- CVE-2026-62960 — Git for Windows: Server-advertised bundle-uri can trigger outbound SMB callbacks via UNC and file:// paths on Windows
- CVE-2026-76572 — pkp pkp-lib XSLTransformer.php _transformPHP xml external entity reference
- CVE-2026-55389 — datamodel-code-generator vulnerable to arbitrary local file read via JSON-Schema `$ref` (`file://` and `../` traversal), bypassing `--no-allow-remote-refs`
- CVE-2026-55390 — Arbitrary local file read via XSD `schemaLocation` (`xs:include`/`xs:import`) path traversal, with no remote-ref gate