RLSA-2026:91490: Moderate: ansible-collection-redhat-leapp security update

Q: What level of access and interaction does exploitation require?

The severity vector indicates network reachability and low attack complexity, but requires high privileges and user interaction. The scope is changed, with high confidentiality impact and no integrity or availability impact recorded in the vector.

Q: What information could be exposed or manipulated?

The listed fixes address disclosure of PostgreSQL data through insecure backup permissions and information disclosure through Leapp report tampering. The advisory does not specify affected configurations, package versions, or detection steps.

Published Oct 30, 2026

Updated

redhat.leapp Ansible collection that handles Rocky Linux upgrades.

Security Fix(es):

ansible-collection-redhat-leapp: ansible-collection-redhat-leapp: Information disclosure of PostgreSQL data via insecure backup permissions (CVE-2026-68563)

ansible-collection-redhat-leapp: ansible-collection-redhat-leapp: Information disclosure via Leapp report tampering (CVE-2026-68562)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected Software

1 affected componentFixes available

rocky-linux/ansible-collection-redhat-leapp<0:1.7.4-2.el9_8

0:1.7.4-2.el9_8

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade rocky-linux/ansible-collection-redhat-leapp to a version that resolves this vulnerability.
Fixed in 0:1.7.4-2.el9_8

Event History

Oct 30, 2026

Advisory Published

via OSV·12:04 PM

Data Sourced

via OSV·12:04 PM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

What level of access and interaction does exploitation require?

The severity vector indicates network reachability and low attack complexity, but requires high privileges and user interaction. The scope is changed, with high confidentiality impact and no integrity or availability impact recorded in the vector.

What information could be exposed or manipulated?

The listed fixes address disclosure of PostgreSQL data through insecure backup permissions and information disclosure through Leapp report tampering. The advisory does not specify affected configurations, package versions, or detection steps.

RLSA-2026:91490: Moderate: ansible-collection-redhat-leapp security update

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What level of access and interaction does exploitation require?

What information could be exposed or manipulated?

Company

Resources

Contact

Frequently Asked Questions

What level of access and interaction does exploitation require?

What information could be exposed or manipulated?