CVE-2026-103868
Medium
Description
A flaw was found in pulp-container when it authenticates to an upstream registry. Basic and bearer credentials from one remote are reused for later downloads in the same worker. A user who can sync a container remote, and can point that remote at a server they control, receives the username, password, or bearer token stored for a different remote, and can reuse that credential at the upstream registry. Content stored in Pulp is not changed, and the service is not stopped.
SeverityMedium
CVSS6.5
Exploit probability—
Product
Red Hat Ansible Automation Platform 2
PublishedOct 7, 2026
First seenOct 7, 2026
Weakness typeCWE-488CWE-488
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat Red Hat Ansible Automation Platform 2 | No range specified | — |
| Red Hat Red Hat Satellite 6 | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.