A flaw in the Ansible Red Hat leapp collection allows an attacker with privileged write access to a managed node’s Leapp report to alter that report. When an operator runs the leapp_corrupted_grubenv_file remediation, the modified report is read by the Ansible controller, which then copies its own local controller files onto the managed node, exposing sensitive data such as private keys or credentials. This vulnerability is a CWE‑610 information exposure issue.

The vulnerability affects systems running Red Hat Enterprise Linux 10 and 9 that use the ansible‑collection‑redhat‑leapp. The issue lies in the way the controller processes the Leapp report sent from the managed nodes.

The CVSS score is 6.2, indicating medium severity. The EPSS score is less than 1 percent, meaning the likelihood of exploitation is low but not zero. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an actor who can write to the Leapp report on a managed node and then trigger the remediation task, so the attack vector is limited to internal or compromised environments. No remote code execution is possible; the main risk is information disclosure of the controller's local files.