CVE-2026-68563

MediumCVSS 5.5/10Last modified Oct 23, 2026

Description

A flaw was found in ansible-collection-redhat-leapp. When a remediation task is executed with elevated privileges and the `leapp_old_postgresql_data` option is selected, a PostgreSQL data backup archive is created with insecure permissions. This allows a local non-root user on the managed node to read sensitive archived PostgreSQL data, leading to information disclosure.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-732

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Jul 30, 2026
Last modified: Oct 23, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-685647.1Unauthenticated Cross Site Scripting (XSS) in NotificationX Pro <= 3.1.4 versions.CVE-2026-685656.5Contributor Cross Site Scripting (XSS) in GeoDirectory <= 2.8.172 versions.CVE-2026-685669.3Unauthenticated SQL Injection in BookingPress Appointment Booking Pro <= 6.0.2 versions.CVE-2026-685677.1Unauthenticated Cross Site Scripting (XSS) in Convert Pro <= 1.0.1 versions.CVE-2026-685686.3Subscriber Privilege Escalation in MasterStudy LMS <= 3.7.41 versions.CVE-2026-685698.1Improper Authentication vulnerability in Apache Tomcat meant that in some circumstances (e.g. CLIENT-CERT, SPNEGO) that a user would be auth CVE-2026-68577.5A flaw was found in camel-infinispan. This vulnerability involves unsafe deserialization in the ProtoStream remote aggregation repository. A CVE-2026-685706.5Incorrect Authorization vulnerability in Apache Doris allows an authenticated user to bypass privilege checks and access data they are not a CVE-2026-685718.8Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Kylin. Special parameter in JDBC URL can lead to code inje CVE-2026-685727.5Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Kylin. This issue affects Apache Kylin: from 4 through CVE-2026-685739.8Improper Authentication vulnerability in Apache Kylin. Unauthenticated user may access to system cleanup actions. Impact most to the kylin s CVE-2026-685787.5ArcadeDB versions before 26.7.3 fail to bind the authenticated principal in the MCP HTTP transport, causing all engine permission checks to