CVE-2026-68563: Ansible-collection-redhat-leapp: ansible-collection-redhat-leapp: information disclosure of postgresql data via insecure backup permissions

AIONLYREPORT package: ansible-collection-redhat-leapp-1.7.4-1.el102 ------ Summary: Insecure Permissions on PostgreSQL Backup on Managed Node: the remediation task creates a PostgreSQL data backup archive with mode 0755, allowing local non-root users on the managed node to read archived PostgreSQL data after remediation runs. Requirements to exploit: A local authenticated user account on a managed node where the remediation workflow is executed with elevated privileges, leappoldpostgresqldata is selected, and /var/lib/pgsql/data exists when the task runs. Component affected: ansible-collection-redhat-leapp-1.7.4-1.el102, roles/remediate/tasks/leappoldpostgresqldata.yml, task leappoldpostgresqldata Version affected: ansible-collection-redhat-leapp-1.7.4-1.el102 Patch available: no released package fix established; proposed patch included below Version fixed: unknown Upstream coordination: Not notified. CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - 5.5 (MEDIUM) AV:L - Exploitation requires local access to the managed node. AC:L - Once the remediation runs, the exposed archive can be read directly with standard tools. PR:L - The attacker needs a local account or equivalent local session on the affected system. UI:N - No separate user interaction is required after the archive is created. S:U - The impact is confined to the same security scope. C:H - The archive may contain the full PostgreSQL data directory and therefore sensitive database contents. I:N - The issue is an information exposure; the report does not establish unauthorized modification. A:N - The report does not establish a direct availability impact. Impact: Moderate. This issue can expose sensitive PostgreSQL data to local non-root users, but exploitation is not remote and depends on a specific remediation path being executed on systems that still contain /var/lib/pgsql/data. Under the Red Hat severity guidance, this is more appropriately classified as Moderate than Important because the exposure is conditional and local, even though the confidentiality impact can be significant on affected hosts. Embargo: no Reason: This is a local, configuration- and workflow-dependent confidentiality issue with straightforward mitigation by tightening backup directory and archive permissions. Acknowledgement: Aisle Research Vulnerability Details: The remediation task archives /var/lib/pgsql/data into /var/backups, then explicitly sets the resulting archive to mode 0755. That makes the backup world-readable on typical systems. The task then removes the original PostgreSQL data directory, leaving the backup archive as the remaining copy in this workflow. The same task also sets /var/backups to 0755, which may preserve or broaden directory readability depending on the existing system state. This remediation is part of the intended remediation flow for the Leapp inhibitor Old PostgreSQL data found in /var/lib/pgsql/data. yaml name: leappoldpostgresqldata | Ensure /var/backups exists ansible.builtin.file: path: "{{ postgresqlbackuppath }}" state: directory mode: "0755"

name: leappoldpostgresqldata | Create tar.gz archive of postgresql data ansible.builtin.command: # noqa: command-instead-of-module cmd: tar -czf {{ postgresqlbackuppath }}/{{ backupfilename }} {{ postgresqldatapath }} changedwhen: true

name: leappoldpostgresqldata | Set permissions on backup archive ansible.builtin.file: path: "{{ postgresqlbackuppath }}/{{ backupfilename }}" mode: "0755"

name: leappoldpostgresqldata | Remove original postgresql data ansible.builtin.file: path: "{{ postgresqldatapath }}" state: absent

The core security consequence established here is local confidentiality loss. The available evidence does not establish a direct integrity or availability impact, and it does not show remote reachability. Steps to reproduce: 1. Prepare a managed node with /var/lib/pgsql/data present and populate it with sample files. 2. Run the remediation workflow so that task leappoldpostgresqldata executes with elevated privileges. 3. Confirm that a backup archive named pgsqldatabackup.tar.gz is created under /var/backups. 4. Check the resulting permissions with stat -c '%a %U:%G %n' /var/backups /var/backups/pgsqldatabackup.tar.gz. 5. From a non-root local account, list the archive contents with tar -tzf /var/backups/pgsqldatabackup.tar.gz. 6. Observe that the archive remains readable to the local user while the original /var/lib/pgsql/data has been removed by the remediation. Mitigation: Until a package fix is available, store these remediation backups in a root-only directory and set the archive permissions to 0600. If the current task must be used as-is, restrict local-user access on affected systems and remove or re-permission the generated backup archive immediately after it is created. Proposed Fix: Restrict the backup location to a dedicated root-owned directory and make the generated archive readable only by root. diff diff --git a/roles/remediate/tasks/leappoldpostgresqldata.yml b/roles/remediate/tasks/leappoldpostgresqldata.yml index 0000000..1111111 100644 — a/roles/remediate/tasks/leappoldpostgresqldata.yml +++ b/roles/remediate/tasks/leappoldpostgresqldata.yml @@ -2,8 +2,9 @@ name: leappoldpostgresqldata | Backup and then remove /var/lib/pgsql/data for remediation vars: postgresqldatapath: /var/lib/pgsql/data

postgresqlbackuppath: /var/backups + postgresqlbackuppath: /var/backups/leapp block: @@ -27,7 +28,10 @@

name: leappoldpostgresqldata | Ensure /var/backups exists ansible.builtin.file: path: "{{ postgresqlbackuppath }}" state: directory

mode: "0755" + owner: root + group: root + mode: "0700"

@@ -38,7 +42,10 @@ name: leappoldpostgresqldata | Set permissions on backup archive ansible.builtin.file: path: "{{ postgresqlbackuppath }}/{{ backupfilename }}"

mode: "0755" + owner: root + group: root + mode: "0600"

------ This report was generated using AI technology. Always review AI-generated content prior to use

— Red Hat