[ CVE-2026-103868 · Published 7 Oct 2026 ]
Vulnerability in Red Hat Ansible Automation Platform 2
CVSS 6.5
EPSS <1%No fix listed yet
[ Description ]Official description
A flaw was found in pulp-container when it authenticates to an upstream registry. Basic and bearer credentials from one remote are reused for later downloads in the same worker. A user who can sync a container remote, and can point that remote at a server they control, receives the username, password, or bearer token stored for a different remote, and can reuse that credential at the upstream registry. Content stored in Pulp is not changed, and the service is not stopped.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.