TLS Certificate Validation Flaw in OCAPI Modules of Ansible Collection by Red Hat
CVE-2026-87872

6.8MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Ceph Storage 5
Red Hat Ceph Storage 9
Red Hat Openstack Platform 17.1
Red Hat Openstack Platform 18.0
Vendor
CVE Published:
9 September 2026

What is CVE-2026-87872?

A significant vulnerability exists in the OCAPI modules of the community.general Ansible collection, where TLS certificate validation is disabled for all requests. This flaw allows attackers positioned within the network path to exploit unsecured connections. Without the ability to re-enable TLS validation, sensitive HTTP Basic Authentication credentials are sent to HTTPS endpoints without proper security measures. Consequently, attackers can intercept sessions, capture credentials, and manipulate responses, posing serious security threats to users and their configurations.

References

https://access.redhat.com/security/cve/CVE-2026-87872
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2530988
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
6.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank Jeong Woochang for reporting this issue.
.