CVE-2026-68563 Details

A vulnerability exists in the Ansible collection 'redhat-leapp' version 1.7.4-1.el10_2. When the 'leapp_old_postgresql_data' remediation task is run with elevated privileges, it creates a backup of PostgreSQL data in a world-readable archive. This flaw allows local non-root users on the managed node to access sensitive PostgreSQL data, leading to unauthorized information disclosure. The issue arises because the backup archive is created with insecure permissions, allowing exposure of archived data from the PostgreSQL directory.

To address this vulnerability, it is recommended to adjust the permissions of the backup directory and the archive itself. The backup directory should be set to '0700' and owned by root, while the backup archive should have '0600' permissions. If the 'leapp_old_postgresql_data' task must be used as is, local user access on affected systems should be restricted, and the generated backup archive should be promptly re-permissioned or removed after creation.