This vulnerability involves incorrect permission assignment for a critical resource in Red Hat Enterprise Linux 10's ansible-collection-redhat-leapp. Specifically, during remediation tasks executed with elevated privileges that select the leapp_old_postgresql_data option, the PostgreSQL data backup archive is created with permissions that are too permissive. Consequently, local non-root users on the managed node can access and read sensitive archived PostgreSQL data. The CVSS 3.1 base score is 5.5, reflecting a medium severity with local attack vector, low attack complexity, and low privileges required. There is no vendor advisory indication of an official fix or patch availability at this time.

The vulnerability allows local non-root users on the affected system to read sensitive PostgreSQL backup data due to insecure file permissions on the backup archive. This leads to information disclosure but does not affect integrity or availability. The impact is limited to confidentiality compromise of archived PostgreSQL data on the managed node.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-68563 for current remediation guidance. Until an official fix is available, restrict local user access on managed nodes and avoid using the leapp_old_postgresql_data option in remediation tasks if possible to reduce exposure.