Executive brief
The community.general Ansible collection contains OCAPI modules (ocapi_command and ocapi_info) used to manage storage and enclosure devices. These modules disable TLS certificate validation and send HTTP Basic-Auth credentials over HTTPS with no way to re-enable validation. An attacker on the network between an Ansible controller and the target device can intercept communications, steal credentials, and modify responses.
Technical details
The vulnerability is a failure to properly validate TLS certificates (CWE-295) in the OCAPI request helper used by ocapi_command and ocapi_info modules. The shared helper function hardcodes validate_certs=False with no parameter override, disabling certificate validation on all HTTPS requests. An attacker positioned on the network path between the Ansible controller and the OCAPI-managed device can exploit this by presenting a malicious certificate to intercept the session, capture Basic-Auth credentials in transit, and tamper with API responses. The attack requires an on-path network position (adjacent network), making it viable in untrusted management network segments. No patch has been released as of the advisory date; mitigation involves restricting OCAPI module usage to fully trusted/isolated management network paths.
Affected products
- Ansible community.general versions with OCAPI modules (ocapi_command, ocapi_info) prior to fix
Timeline
- 2026-09-09: disclosed