Is CVE-2026-87872 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-87872 being exploited in the wild.

How severe is CVE-2026-87872?

Medium severity, with a CVSS score of 6.8, published 9 September 2026.

Which products and versions are affected?

Ansible community.general versions with OCAPI modules (ocapi_command, ocapi_info) prior to fix.

Is there a fix for CVE-2026-87872?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-87872 attacked?

It is attacked from the adjacent network.

Am I affected by CVE-2026-87872?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-87872: Ansible community.general OCAPI modules TLS certificate validation bypass

CVE-2026-87872 · Severity: medium · CVSS 6.8 · Published 2026-09-09

The community.general Ansible collection contains OCAPI modules (ocapi_command and ocapi_info) used to manage storage and enclosure devices. These modules disable TLS certificate validation and send HTTP Basic-Auth credentials over HTTPS with no way to re-enable validation. An attacker on the network between an Ansible controller and the target device can intercept communications, steal credentials, and modify responses.

Quick answers

Is CVE-2026-87872 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-87872 being exploited in the wild.
How severe is CVE-2026-87872?: Medium severity, with a CVSS score of 6.8, published 9 September 2026.
Which products and versions are affected?: Ansible community.general versions with OCAPI modules (ocapi_command, ocapi_info) prior to fix.
Is there a fix for CVE-2026-87872?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-87872 attacked?: It is attacked from the adjacent network.
Am I affected by CVE-2026-87872?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a failure to properly validate TLS certificates (CWE-295) in the OCAPI request helper used by ocapi_command and ocapi_info modules. The shared helper function hardcodes validate_certs=False with no parameter override, disabling certificate validation on all HTTPS requests. An attacker positioned on the network path between the Ansible controller and the OCAPI-managed device can exploit this by presenting a malicious certificate to intercept the session, capture Basic-Auth credentials in transit, and tamper with API responses. The attack requires an on-path network position (adjacent network), making it viable in untrusted management network segments. No patch has been released as of the advisory date; mitigation involves restricting OCAPI module usage to fully trusted/isolated management network paths.

Affected products

Ansible community.general versions with OCAPI modules (ocapi_command, ocapi_info) prior to fix

Timeline

2026-09-09: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.