CVE-2026-87872

Awaiting Analysis Awaiting Analysis - Queue

OCAPI Command Module TLS Certificate Validation Bypass

Publication date: 2026-09-09

Last updated on: 2026-09-14

Assigner: redhat-SADP

Description

A flaw was found in the OCAPI modules (ocapi_command, ocapi_info) of the community.general Ansible collection. The shared OCAPI request helper disables TLS certificate validation on every request and the modules expose no parameter to re-enable it, while sending HTTP Basic-Auth credentials to an https endpoint. An attacker positioned on the network path between the Ansible controller and the OCAPI-managed storage/enclosure device can present any certificate, intercept the session, capture the credentials, and tamper with responses.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-09

Last Modified

2026-09-14

Generated

2026-09-30

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-29

NVD

CVE-2026-87872

EUVD

EUVD-2026-75086

Affected Vendors & Products

Vendor	Product	Version / Range
community.general	ansible_collection	to 2.11.0 (exc)
community.general	ansible_collection	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-295	The product does not validate, or incorrectly validates, a certificate.

Attack-Flow Graph

Executive Summary

This vulnerability is in the OCAPI modules (ocapi_command, ocapi_info) of the community.general Ansible collection. The shared OCAPI request helper disables TLS certificate validation on every request, and the modules do not provide a way to re-enable it. This means HTTP Basic-Auth credentials are sent to an HTTPS endpoint without proper security checks.

Detection Guidance

Detecting this vulnerability requires checking if the community.general Ansible collection's OCAPI modules (ocapi_command, ocapi_info) are used without TLS certificate validation. Inspect Ansible playbooks and roles for these modules. Network monitoring tools can detect unencrypted or improperly secured OCAPI traffic between the controller and storage/enclosure devices.

Impact Analysis

An attacker on the network path between the Ansible controller and the OCAPI-managed device can intercept the session, capture credentials, and tamper with responses. This could lead to unauthorized access, data theft, or manipulation of storage/enclosure device settings.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Failure to protect credentials and data in transit may result in non-compliance with these regulations.

Mitigation Strategies

Restrict OCAPI module usage to fully trusted or isolated management networks. Rotate OCAPI Basic-Auth credentials if exposure is suspected. Avoid using the community.general collection's OCAPI modules until a patch is available. Monitor network traffic for suspicious activity between the Ansible controller and OCAPI-managed devices.

Hi! I’m here to help you understand CVE-2026-87872. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70