Executive brief
A vulnerability exists in the Red Hat Leapp collection for Ansible, a tool used to automate system upgrades. If an attacker has administrative access to a managed server, they can tamper with upgrade reports to trick the central Ansible controller into sending its own sensitive files (such as private keys or credentials) to the managed server. This occurs when an administrator runs a specific remediation task to fix corrupted boot files, potentially leading to the theft of highly sensitive management credentials.
Technical details
An information disclosure vulnerability exists in the `leapp_corrupted_grubenv_file` remediation task within the `ansible-collection-redhat-leapp` collection. The vulnerability stems from the `ansible.builtin.copy` module being used without `remote_src: true` on paths extracted from an attacker-controlled Leapp report on the managed node. Because Ansible's `copy` module defaults to the controller as the source, a malicious report can specify sensitive controller-local paths (e.g., `/root/.ssh/id_rsa`) which are then copied to the managed node during the remediation workflow. Exploitation requires the attacker to have privileged write access to the managed node's Leapp report and for an operator to manually trigger the remediation task.
Affected products
- Red Hat ansible-collection-redhat-leapp 1.7.4-1.el10_2
Timeline
- 2026-05-04: disclosed: Reported via Red Hat Bugzilla
- 2026-07-30: advisory: NVD publication date