Vulnerability in Red Hat Enterprise Linux 10

[ Description ]Official description

A flaw was found in ansible-collection-redhat-leapp. An attacker with privileged write access to a managed node's Leapp report content can manipulate it. When an operator runs a specific remediation task, this manipulated report can cause the Ansible controller to read its own local files and copy them to the managed node. This vulnerability leads to information disclosure, potentially exposing sensitive controller-side data such as private keys or credentials.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• BSI CERT-Bund27 Oct 2026WID-SEC-2026-4187

  Red Hat Enterprise Linux (libXi, libXrender, ansible-collection-redhat-leapp) and Red Hat Build of Apache Camel for Quarkus: Multiple vulnerabilities Translated from German

  Risk highCVE-2026-88807CVE-2026-68562CVE-2026-93543+3 more CVEs

[ References ]References

• access.redhat.com/errata/RHSA-2026:91490vendor-advisoryx_refsource_REDHAT
• access.redhat.com/errata/RHSA-2026:91491vendor-advisoryx_refsource_REDHAT
• access.redhat.com/security/cve/CVE-2026-68562vdb-entryx_refsource_REDHAT
• bugzilla.redhat.com/show_bug.cgiissue-trackingx_refsource_REDHAT