Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4

Export CSV
CVE-2026-68563

Ansible-collection-redhat-leapp: ansible-collection-redhat-leapp: information disclosure of postgresql data via insecure backup permissions

A flaw was found in ansible-collection-redhat-leapp. When a remediation task is executed with elevated privileges and the `leapp_old_postgresql_data` option is selected, a PostgreSQL data backup archive is created with insecure permissions. This allows a local non-root user on the managed node to read sensitive archived PostgreSQL data, leading to information disclosure.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Ansible Collection Enterprise Linux
CVE-2026-68562

Ansible-collection-redhat-leapp: ansible-collection-redhat-leapp: information disclosure via leapp report tampering

A flaw was found in ansible-collection-redhat-leapp. An attacker with privileged write access to a managed node's Leapp report content can manipulate it. When an operator runs a specific remediation task, this manipulated report can cause the Ansible controller to read its own local files and copy them to the managed node. This vulnerability leads to information disclosure, potentially exposing sensitive controller-side data such as private keys or credentials.

CVSS 3.1 · 6.2 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Ansible Collection Enterprise Linux
CVE-2023-4237

Platform: ec2_key module prints out the private key directly to the standard output

A flaw was found in the Ansible Automation Platform. When creating a new keypair, the ec2_key module prints out the private key directly to the standard output. This flaw allows an attacker to fetch those keys from the log files, compromising the system's confidentiality, integrity, and availability.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Ansible Automation Platform Ansible Automation Platform Cloud Billing Ansible Collection
CVE-2022-3697

ansible: improper handling of tower_callback parameter in amazon.aws collection

A flaw was found in Ansible in the amazon.aws collection when using the tower_callback parameter from the amazon.aws.ec2_instance module. This flaw allows an attacker to take advantage of this issue as the module is handling the parameter insecurely, leading to the password leaking in the logs.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Ansible Ansible Collection