CVE-2025-68121 is a vulnerability in the crypto/tls component used by Red Hat Ansible Automation Platform 2.6. It occurs during TLS session resumption when the certificate authority (CA) settings are modified between the initial handshake and the resumed handshake. This flaw allows an attacker to bypass certificate validation, enabling a client or server to establish a TLS connection that should have been rejected, resulting in an authentication bypass under specific conditions. The vulnerability requires a high attack complexity due to the need for TLS session resumption combined with runtime CA configuration changes. The scope of the vulnerability is unchanged as it affects only the TLS component. The impact includes high confidentiality and integrity risks but no availability impact. Red Hat has issued a security advisory with a fix for affected versions.

The vulnerability allows bypassing certificate validation during TLS session resumption, which can lead to authentication bypass. This compromises the confidentiality and integrity of TLS connections established under these conditions. The impact is limited to the crypto/tls component and does not affect system availability. Exploitation is complex and requires specific runtime conditions, reducing the likelihood of widespread exploitation. No known exploits are reported in the wild at this time.

Red Hat has released a security advisory (RHSA-2026:29854) that includes a fix for this vulnerability. Users of Red Hat Ansible Automation Platform 2.6 should apply the update to versions 2.7.0 or later where the issue is resolved. Before applying the update, ensure all previously released errata relevant to your system have been applied. No additional mitigations are specified by the vendor. Patch status is confirmed as fixed in versions 2.7.0 and later.