CVE-2026-87872: Ansible OCAPI Modules Credential Disclosure

CVE-2026-87872 Overview

CVE-2026-87872 is an improper certificate validation flaw [CWE-295] in the ocapi_command and ocapi_info modules of the community.general Ansible collection. The shared Open Composable API (OCAPI) request helper disables TLS certificate validation on every request. The affected modules expose no parameter to re-enable validation, yet they transmit HTTP Basic authentication credentials to HTTPS endpoints. An attacker with adjacent network access between the Ansible controller and the OCAPI-managed storage or enclosure device can present any certificate, intercept the session, capture credentials, and tamper with responses.

Critical Impact
Attackers on the network path can perform machine-in-the-middle attacks to steal HTTP Basic-Auth credentials for OCAPI-managed storage and enclosure devices and modify command responses.

Affected Products

community.general Ansible collection — ocapi_command module
community.general Ansible collection — ocapi_info module
Red Hat Ansible deployments shipping the affected collection

Discovery Timeline

2026-09-09 - CVE CVE-2026-87872 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87872

Vulnerability Analysis

The OCAPI modules in community.general rely on a shared request helper to communicate with storage and enclosure devices over HTTPS. That helper unconditionally disables TLS certificate validation. Neither ocapi_command nor ocapi_info exposes a validate_certs parameter to override the behavior. Users have no supported mechanism to enforce validation from playbooks.

The modules authenticate to the remote OCAPI endpoint using HTTP Basic authentication. Credentials travel inside a session that never verifies the server certificate chain or hostname. An attacker with adjacent network position can present an attacker-controlled certificate and complete the TLS handshake without triggering an error. The Ansible controller proceeds to send credentials and receive tampered responses.

Exploitation requires the attacker to sit on the network segment between the Ansible controller and the target device. That constraint drives the attack complexity higher than a remote-only flaw, but the impact on confidentiality and integrity is significant once positioned.

Root Cause

The root cause is an insecure default in the shared OCAPI helper combined with missing parameter exposure. The helper hardcodes certificate validation to off, and the module interfaces do not surface any option to re-enable it. This constitutes improper certificate validation [CWE-295].

Attack Vector

The attack requires adjacent network access. An adversary on the same broadcast domain, VLAN, or routed path between controller and device can use ARP spoofing, rogue DHCP, DNS poisoning, or a compromised network device to intercept traffic. The attacker then presents any TLS certificate, terminates the TLS session, forwards or modifies requests to the real device, and captures the Basic-Auth header for later reuse.

See the Red Hat CVE-2026-87872 Advisory and Red Hat Bug Report #2530988 for vendor technical detail.

Detection Methods for CVE-2026-87872

Indicators of Compromise

Unexpected TLS certificates presented by OCAPI-managed storage or enclosure devices, especially self-signed certificates or certificates that changed without a scheduled rotation.
ARP table anomalies, duplicate MAC addresses, or unexpected default gateway changes on VLANs carrying Ansible-to-storage traffic.
Unrecognized authentication events on OCAPI devices originating from IP addresses other than the known Ansible controller.

Detection Strategies

Inspect playbooks and roles for use of community.general.ocapi_command and community.general.ocapi_info and inventory the storage devices they target.
Capture traffic between the Ansible controller and OCAPI endpoints and validate that server certificates match a trusted internal certificate authority.
Alert on TLS sessions to OCAPI endpoints where the certificate issuer, serial, or fingerprint deviates from a known-good baseline.

Monitoring Recommendations

Enable authentication and configuration-change logging on OCAPI-managed storage and enclosure devices and forward logs to a central platform.
Monitor the network segments carrying Ansible control traffic for Layer 2 attacks such as ARP spoofing and rogue DHCP responses.
Track invocations of the affected modules in Ansible controller logs and correlate against device-side audit trails.

How to Mitigate CVE-2026-87872

Immediate Actions Required

Restrict execution of ocapi_command and ocapi_info to trusted, isolated management networks with no path for adjacent attackers.
Rotate any HTTP Basic-Auth credentials previously used with the OCAPI modules on the assumption they may have been exposed.
Audit inventories to identify every Ansible controller and target device that has used the affected modules.

Patch Information

Refer to the Red Hat CVE-2026-87872 Advisory for fix status and the updated community.general collection version. Upgrade the collection on all Ansible controllers once the fixed release is available and confirm that a validate_certs parameter is exposed and defaults to enabled.

Workarounds

Place the Ansible controller and OCAPI devices on a dedicated, physically or logically isolated management VLAN with strict access controls.
Use IPsec or an equivalent authenticated transport between the controller and target devices to remove the attacker's ability to intercept traffic.
Disable HTTP Basic authentication on OCAPI devices where possible and use short-lived credentials scoped to the minimum required operations.

bash

# Configuration example: pin community.general to a fixed release once available
ansible-galaxy collection install 'community.general:>=FIXED_VERSION' --force

# Verify installed version
ansible-galaxy collection list community.general