CVE-2026-68562

A flaw was found in ansible-collection-redhat-leapp. An attacker with privileged write access to a managed node's Leapp report content can manipulate it. When an operator runs a specific remediation task, this manipulated report can cause the Ansible controller to read its own local files and copy them to the managed node. This vulnerability leads to information disclosure, potentially exposing sensitive controller-side data such as private keys or credentials.

This Moderate severity flaw in ansible-collection-redhat-leapp allows an attacker with privileged write access on a managed node to tamper with Leapp report content. When an operator subsequently runs the leapp_corrupted_grubenv_file remediation, the Ansible controller may be tricked into disclosing sensitive controller-local files to the compromised managed node, crossing a trust boundary. Exploitation depends on both prior compromise of the managed node and specific operator action.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, avoid running the leapp_corrupted_grubenv_file remediation against managed nodes whose Leapp report content is not trusted. As a local hardening measure, modify the relevant Ansible playbook to explicitly set remote_src: true for ansible.builtin.copy tasks within the leapp_corrupted_grubenv_file role. Additionally, implement path validation to ensure that src paths are strictly confined to the expected /boot subtree. These changes require re-execution of the Ansible playbook to take effect.