CVE-2026-68563

Received Received - Intake

Insecure PostgreSQL Backup Permissions in Ansible Collection Red Hat Leapp

Publication date: 2026-07-30

Last updated on: 2026-07-30

Assigner: Red Hat, Inc.

Description

A flaw was found in ansible-collection-redhat-leapp. When a remediation task is executed with elevated privileges and the `leapp_old_postgresql_data` option is selected, a PostgreSQL data backup archive is created with insecure permissions. This allows a local non-root user on the managed node to read sensitive archived PostgreSQL data, leading to information disclosure.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-30

Last Modified

2026-07-30

Generated

2026-07-31

AI Q&A

2026-07-31

EPSS Evaluated

N/A

NVD

CVE-2026-68563

EUVD

EUVD-2026-51315

Affected Vendors & Products

Vendor	Product	Version / Range
redhat	ansible_collection_redhat_leapp	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-732	The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

Attack-Flow Graph

Executive Summary

This vulnerability is in ansible-collection-redhat-leapp. When a remediation task runs with high privileges and the PostgreSQL data backup option is chosen, a backup archive is created with weak file permissions. A local non-root user on the affected system can then access this archive and read sensitive PostgreSQL data, which could include confidential information.

Detection Guidance

Check for PostgreSQL data backup archives created by ansible-collection-redhat-leapp with insecure permissions. Use commands like 'find / -type f -perm /o+r -name '*postgresql*' 2>/dev/null' to locate files readable by others. Verify if 'leapp_old_postgresql_data' was used in recent remediation tasks.

Impact Analysis

If you manage systems using ansible-collection-redhat-leapp, an attacker with local access to a managed node could exploit this flaw to read archived PostgreSQL data. This may lead to unauthorized access to sensitive information such as database contents, user credentials, or other confidential data stored in the backups.

Compliance Impact

This vulnerability could violate compliance requirements under GDPR or HIPAA by allowing unauthorized access to personal or health-related data stored in PostgreSQL backups. Organizations may face legal penalties, loss of trust, and increased scrutiny if such data breaches occur due to insecure permissions on backup archives.

Mitigation Strategies

Remove or restrict access to any PostgreSQL backup archives created by ansible-collection-redhat-leapp. Set strict permissions (e.g., chmod 600) on these files. Update ansible-collection-redhat-leapp to the latest version to address the insecure permission flaw.

Hi! I’m here to help you understand CVE-2026-68563. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70