A flaw was found in the OCAPI modules (ocapi_command, ocapi_info) of the community.general Ansible collection. (CVE-2026-87872)
Description
A vulnerability in the OCAPI modules (ocapi_command, ocapi_info) of the community.general Ansible collection disables TLS certificate validation on every request. The modules do not provide an option to re-enable certificate validation while sending HTTP Basic-Auth credentials to an HTTPS endpoint. This flaw allows a network attacker positioned between the Ansible controller and the OCAPI-managed device to intercept and tamper with communications and capture credentials.
CVSS v3.1
Score 6.8medium
Affected software
pkg:deb/ubuntu/ansible?arch=source&distro=esm-infra-legacy/trustypkg:deb/ubuntu/ansible?arch=source&distro=esm-apps/xenialpkg:deb/ubuntu/ansible?arch=source&distro=esm-apps/bionicpkg:deb/ubuntu/ansible?arch=source&distro=esm-apps/focalpkg:deb/ubuntu/ansible-core?arch=source&distro=jammypkg:deb/ubuntu/ansible?arch=source&distro=esm-apps/jammypkg:deb/ubuntu/ansible?arch=source&distro=noblepkg:deb/ubuntu/ansible-core?arch=source&distro=noblepkg:deb/ubuntu/ansible?arch=source&distro=stonkingpkg:deb/ubuntu/ansible-core?arch=source&distro=stonkingpkg:deb/ubuntu/ansible?arch=source&distro=resolutepkg:deb/ubuntu/ansible-core?arch=source&distro=resoluteRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The community.general Ansible collection's OCAPI modules (ocapi_command, ocapi_info) contain a security flaw where the shared OCAPI request helper disables TLS certificate validation by default and offers no parameter to enable it. As a result, HTTP Basic-Auth credentials are sent over HTTPS without proper certificate verification. An attacker on the network path can present any certificate, intercept the session, capture credentials, and tamper with responses from the OCAPI-managed storage or enclosure device.
Potential Impact
An attacker with network access between the Ansible controller and the OCAPI-managed device can perform man-in-the-middle attacks by presenting arbitrary TLS certificates. This enables interception of HTTP Basic-Auth credentials, compromising confidentiality and integrity of the session. The vulnerability impacts confidentiality and integrity but does not affect availability.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using the vulnerable OCAPI modules in untrusted or exposed network environments. Consider using alternative methods or modules that enforce TLS certificate validation.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- UBUNTU-CVE-2026-87872
- Osv Schema Version
- 1.7.0
- Ecosystems
- ["Ubuntu:Pro:14.04:LTS","Ubuntu:Pro:16.04:LTS","Ubuntu:Pro:18.04:LTS","Ubuntu:Pro:20.04:LTS","Ubuntu:22.04:LTS","Ubuntu:Pro:22.04:LTS","Ubuntu:24.04:LTS","Ubuntu:26.10","Ubuntu:26.04:LTS"]
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ad3f54b2cdf04f65665867e
Added to database: 10/17/2026, 22:23:07 UTC
Last enriched: 10/17/2026, 23:21:53 UTC
Last updated: 10/17/2026, 23:21:53 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.