CVE-2026-87872: Community.general: community.general: ocapi module_utils (ocapi_command, ocapi_info) hardcode validate_certs=false with no override, enabling tls man-in-the-middle and credential disclosure
A flaw was found in the OCAPI modules (ocapicommand, ocapiinfo) of the community.general Ansible collection. The shared OCAPI request helper disables TLS certificate validation on every request and the modules expose no parameter to re-enable it, while sending HTTP Basic-Auth credentials to an https endpoint. An attacker positioned on the network path between the Ansible controller and the OCAPI-managed storage/enclosure device can present any certificate, intercept the session, capture the credentials, and tamper with responses.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Ansible environments that use the community.general ocapi_command or ocapi_info modules to connect over HTTPS to an OCAPI-managed storage or enclosure device are exposed. The attacker must be able to position themselves on the network path between the Ansible controller and that device.
Is a non-default setting required for exploitation?
No. The shared OCAPI request helper disables TLS certificate validation on every request, and these modules provide no parameter to enable validation. HTTPS connections made through the affected modules therefore accept an attacker-provided certificate.
What can an attacker obtain or change?
A network-path attacker can intercept HTTP Basic-Auth credentials sent by the modules and tamper with OCAPI responses. The reported impact includes high confidentiality and integrity impact, with no availability impact stated.
What can be done while a fix is unavailable?
Restrict and protect the network path between the Ansible controller and the OCAPI-managed device so an attacker cannot intercept that traffic. Because the modules offer no certificate-validation override, module configuration cannot restore TLS certificate verification.