Executive brief
A security flaw was found in the Red Hat Leapp Ansible collection, which is used to automate system upgrades. When backing up old PostgreSQL database data during a system upgrade, the tool creates backup files with insecure permissions that allow any local user on the system to read the contents. This could lead to the exposure of sensitive database information to unauthorized individuals with access to the server.
Technical details
An incorrect permission assignment (CWE-732) exists in the `leapp_old_postgresql_data` task within the `remediate` role of `ansible-collection-redhat-leapp`. When the `leapp_old_postgresql_data` option is enabled, the Ansible task archives the `/var/lib/pgsql/data` directory to `/var/backups` and explicitly sets the file mode to `0755`. Because this task is typically executed with elevated privileges, it creates a world-readable archive of sensitive database files. A local attacker with low-privileged access to the managed node can read the resulting `.tar.gz` archive to extract PostgreSQL data. As of the advisory date, a formal package fix is pending, but manual mitigation involves restricting the `/var/backups` directory to root-only access or changing archive permissions to `0600`.
Affected products
- Red Hat ansible-collection-redhat-leapp 1.7.4-1.el10_2
Timeline
- 2026-05-04: other: Vulnerability reported to Red Hat Bugzilla
- 2026-07-30: advisory: CVE-2026-68563 published by Red Hat and NVD