The community.general Ansible collection’s ocapi_command and ocapi_info modules rely on a shared OCAPI request helper that disables TLS certificate validation on every request and provides no option to override it while sending HTTP Basic‑Auth credentials to an HTTPS endpoint. This design flaw, classified as CWE‑295, enables an attacker positioned on the network path between the Ansible controller and the OCAPI‑managed storage or enclosure device to present a forged certificate, intercept the session, capture the credentials, and modify responses. The result is confidential credential theft and the potential for unauthorized actions on the target device, without providing direct remote code execution.

The vulnerability affects Red Hat Ceph Storage 5 and 9 and Red Hat OpenStack Platform 17.1 and 18.0, all of which can utilize the community.general collection’s OCAPI modules. Specific component or sub‑version details are not provided; the impact applies to any installation of these products that deploys ocapi_command or ocapi_info without mitigation.

The CVSS base score is 6.8, indicating medium severity. No EPSS score is available, and the issue is not listed in the CISA KEV catalog. To exploit the vulnerability an attacker must be able to intercept traffic between the Ansible controller and the target device over a management network that is not fully isolated. Because the flaw involves TLS bypass rather than privilege escalation or code execution, the required conditions are limited to a network compromise. The risk is moderate in environments where the management network traverses untrusted or shared segments.