CVE-2026-103869: Exposure of Data Element to Wrong Session in Red Hat Red Hat Ansible Automation Platform 2

The vulnerability in pulp-ansible's bearer-token refresh for collection remotes involves improper handling of access tokens. Specifically, the access token is stored in a module-level variable and reused for every token download in the worker process. An attacker able to sync an Ansible remote that uses token refresh and control the remote server can obtain an access token issued for a different remote and reuse it at the issuing service. The flaw does not affect the integrity or availability of content stored in Pulp or the service operation.

An attacker with the ability to sync an Ansible remote and control the remote server can obtain and reuse access tokens issued for other remotes. This leads to unauthorized access to resources protected by those tokens (confidentiality impact). There is no impact on data integrity or service availability. The CVSS score is 6.5 (medium severity) reflecting the confidentiality impact with low attack complexity and required privileges.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-103869 for current remediation guidance. No official fix or workaround is stated in the provided data. Users should monitor the vendor advisory for updates and apply any official patches or mitigations once available.