CVE-2026-87872

Name of the Vulnerable Software and Affected Versions community.general Ansible collection (affected versions not specified)

Description A flaw exists in the ocapi command and ocapi info modules of the community.general Ansible collection. The shared OCAPI request helper disables TLS certificate validation for all requests and provides no parameter to re-enable it, even when sending HTTP Basic-Auth credentials to an HTTPS endpoint. A network attacker positioned between the Ansible controller and the OCAPI-managed storage or enclosure device can present a fraudulent certificate to intercept the session, capture credentials, and tamper with responses.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.