Ansible · week of 26 Oct 2026
Ansible security note
Records on this stack that changed between 26 Oct 2026 and the following Monday. Versions come from the stored ranges. A quiet week is not proof the stack is clear.
What changed
RLSA-2026:91491 — Open the advisory
Important: ansible-collection-redhat-leapp security update
Fixed in 0:1.7.4-2.el10_2
What we still do not know
CVE-2026-92982 — Check if you run it
A flaw was found in Ansible Operator Plugins.
No version range is stored, so an installed version cannot be checked.
CVE-2026-68563 — Check if you run it
Ansible-collection-redhat-leapp: ansible-collection-redhat-leapp: information disclosure of postgresql data via insecure backup permissions
No version range is stored, so an installed version cannot be checked.
CVE-2026-68562 — Check if you run it
Ansible-collection-redhat-leapp: ansible-collection-redhat-leapp: information disclosure via leapp report tampering
No version range is stored, so an installed version cannot be checked.
CVE-2026-11837 — Check if you run it
A local privilege escalation vulnerability was found in the ansible.posix authorized_key module.
No version range is stored, so an installed version cannot be checked.
Share this note
Ansible security note, week of 26 Oct 2026: 1 record has a version a customer can check, and 4 still do not. https://zerodayfindings.com/technologies/ansible/notes/2026-W44