Pulp-ansible stored a bearer token in a single module‑level variable and reused it for every download in the worker. A user who can trigger a sync of an Ansible collection remote and point that remote at a server the attacker controls receives the token that belongs to a different remote. The attacker then uses this stolen token to authenticate against the service that originally issued it. The flaw does not alter content stored in Pulp or stop the service, but it allows the reuse of a bearer token beyond its intended scope, potentially granting unauthorized access to the remote service.

This issue affects Red Hat Ansible Automation Platform 2 and Red Hat Satellite 6. All deployments of these products that use pulp‑ansible and perform remote collection synchronization are vulnerable until the vendor releases a security update that isolates bearer tokens per remote.

The CVSS score of 6.5 indicates moderate severity. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread public exploitation yet. The likely attack vector is an authenticated user who can configure and run a sync against an attacker‑controlled remote; the vulnerability is exploitable in an environment where bearer tokens are used for remote collection authentication. No official workaround exists, so only a patch can fully remediate this flaw.