pulp-ansible: collection remote token stored per worker leaks to an attacker-controlled remote

Impact

pulp-ansible keeps the refreshed access token for collection remotes in a single module-level variable shared by every token download in a worker process. A user allowed to sync an Ansible remote, pointing it at a server they control, receives a token that was issued for a different remote and can replay it against the service that issued it. For an operator running Red Hat Satellite or Ansible Automation Platform as the fleet's content and configuration plane, that is credential disclosure for upstream content services - the credentials used to pull the collections that configure GPU nodes. Content already in Pulp is not modified and the service keeps running, so there is no availability impact to schedule around.

Who can reach it

Authenticated user with permission to create or edit an Ansible collection remote in Pulp (via Satellite or AAP) and the ability to point it at a host they control. No access to the host or to the victim remote's credentials is needed.

What to do

Apply the Red Hat updates for Ansible Automation Platform 2 and Satellite 6 as they ship (the record gives no fixed package versions - track the Red Hat CVE page) and restart the Pulp workers, since the leaked state lives in worker process memory. Meanwhile, restrict who may create or modify Ansible remotes to trusted operators, and rotate any upstream collection tokens that untrusted users could have had sync rights over.

References

Related entries

• GitLab CE/EE: malformed CSV import lets an authenticated user stall Sidekiq workersCVE-2026-1403 · GitLab CE/EE (CSV import, Sidekiq worker)Medium
• PostgreSQL pgcrypto: PGP functions emit recoverable cleartext when OpenSSL disables the cipherCVE-2026-14663 · PostgreSQL pgcrypto (pgp_sym_encrypt / pgp_pub_encrypt family)Medium
• Keycloak: authenticated user can exhaust server memory via unbounded Prometheus metric labelsCVE-2026-16100 · Keycloak (user-event Prometheus metrics)Medium
• open-iscsi iscsiuio (DHCPv6 handling): Integer underflow and out-of-bounds read in iscsiuio's DHCPv6 handlingCVE-2026-18727 · open-iscsi iscsiuio (DHCPv6 handling)Medium
• Grafana: injected timeGroup macro in a SQL query exhausts memory and kills the server processCVE-2026-19475 · Grafana SQL data sources (regex macro parsing, timeGroup injected via WHERE clause)Medium
• lldpd (802.1Q VLAN tag stripping in lldpd_decode): lldpd strips 802.1Q VLAN tags by memmove-ing the frame payload fourCVE-2026-46433 · lldpd (802.1Q VLAN tag stripping in lldpd_decode)Medium