CVE-2026-103869

A flaw was found in pulp-ansible's bearer-token refresh for collection remotes. The access token is kept in one module-level variable and reused for every token download in that worker. A user who can sync an Ansible remote that uses token refresh, and can point that remote at a server they...

CVE-2026-103869 Pulp-ansible: bearer tokens are reused across remotes in a worker

A flaw was found in pulp-ansible's bearer-token refresh for collection remotes. The access token is kept in one module-level variable and reused for every token download in that worker. A user who can sync an Ansible remote that uses token refresh, and can point that remote at a server they...

EUVD-2026-94171

A flaw was found in pulp-ansible's bearer-token refresh for collection remotes. The access token is kept in one module-level variable and reused for every token download in that worker. A user who can sync an Ansible remote that uses token refresh, and can point that remote at a server they...

CVE-2026-103869 Pulp-ansible: bearer tokens are reused across remotes in a worker

A flaw was found in pulp-ansible's bearer-token refresh for collection remotes. The access token is kept in one module-level variable and reused for every token download in that worker. A user who can sync an Ansible remote that uses token refresh, and can point that remote at a server they...

CVE-2026-103869

A flaw exists in pulp-ansible regarding the bearer-token refresh mechanism for collection remotes. The application incorrectly stores the access token in a module-level variable , causing it to be reused for every token download within a worker. An attacker capable of syncing an Ansible remote wi...

CVE-2026-103869

A flaw was found in pulp-ansible's bearer-token refresh for collection remotes. The access token is kept in one module-level variable and reused for every token download in that worker. A user who can sync an Ansible remote that uses token refresh, and can point that remote at a server they...

CVE-2026-103869: Exposure of Data Element to Wrong Session

A flaw was found in pulp-ansible's bearer-token refresh for collection remotes. The access token is kept in one module-level variable and reused for every token download in that worker. A user who can sync an Ansible remote that uses token refresh, and can point that remote at a server they...

PT-2026-107394

A flaw was found in pulp-ansible's bearer-token refresh for collection remotes. The access token is kept in one module-level variable and reused for every token download in that worker. A user who can sync an Ansible remote that uses token refresh, and can point that remote at a server they...

pulp-ansible (>=0.22.0, <=0.23.1), pulp-container (>=2.21.0, <=2.22.13) +6 more potentially affected by CVE-2026-90959 via pulpcore (3.69.2)

pulpcore PYPI version 3.69.2 is affected by a known vulnerability. The following packages have a transitive dependency on pulpcore and may be impacted: - pulp-ansible =0.22.0, =2.21.0, =3.3.0, =0.6.0, =0.8.1, =2.4.0, =3.12.0, =3.25.6, =3.27.14 Source cves: CVE-2026-90959 Source advisory:...

pulp-ansible (>=0.21.0, <=0.21.19), pulp-container (>=2.17.0, <=2.20.14) +6 more potentially affected by CVE-2026-90959 via pulpcore (>=3.53.1, <=3.54.1)

pulpcore PYPI version =3.53.1, =0.21.0, =2.17.0, =3.1.0, =0.4.0, =0.7.0, =2.2.0, =3.11.0, =3.24.0, =3.27.0 Source cves: CVE-2026-90959 Source advisory: MEND:CVE-2026-90959...

pulp-ansible (>=0.28.0, <=0.28.10), pulp-container (>=2.26.0, <=2.26.19) +9 more potentially affected by CVE-2026-90959 via pulpcore (3.95.3)

pulpcore PYPI version 3.95.3 is affected by a known vulnerability. The following packages have a transitive dependency on pulpcore and may be impacted: - pulp-ansible =0.28.0, =2.26.0, =3.7.0, =0.7.2, =2.5.0, =3.18.0, =3.32.0, =3.33.1 - pulp-smart-proxy 0.3.0 Source cves: CVE-2026-90959 Source...

galaxy-ng (>=4.2.0a3, <=4.9.2), pulp-2to3-migration (>=0.0.1rc1, <=0.17.0) +12 more potentially affected by CVE-2024-7143 via pulpcore (>=3.0.1, <=3.54.1)

pulpcore PYPI version =3.0.1, =4.2.0a3, =0.0.1rc1, =0.2.0b10, =0.1.0rc4, =1.0.0rc1, =0.1.0b5, =2.0.0b4, =0.1.0rc1, =0.1.0, =0.3.0, =0.1.0a1, =2.0.0a1, =3.0.0b9, =3.0.0, =3.27.0 Source cves: CVE-2024-7143 Source advisory: OSV:PYSEC-2026-1808...

galaxy-ng (>=4.2.0a3, <=4.6.6), pulp-ansible (>=0.2.0b10, <=0.6.2) potentially affected by CVE-2023-5189 via galaxy-importer (>=0.1.1, <=0.4.9)

galaxy-importer PYPI version =0.1.1, =4.2.0a3, =0.2.0b10, =0.6.2 Source cves: CVE-2023-5189 Source advisory: OSV:PYSEC-2026-1401...

galaxy-ng (>=4.2.0a3, <=4.5.5) potentially affected by CVE-2022-3644 via pulp-ansible (>=0.2.0b15, <=0.13.6)

pulp-ansible PYPI version =0.2.0b15, =4.2.0a3, =4.5.5 Source cves: CVE-2022-3644 Source advisory: OSV:PYSEC-2026-900...

PYSEC-2026-900 Plaintext storage of tokens in pulp_ansible

The collection remote for pulpansible stores tokens in plaintext instead of using pulp's encrypted field and exposes them in read/write mode via the API instead of marking it as write only...

Plaintext storage of tokens in pulp_ansible

The collection remote for pulpansible stores tokens in plaintext instead of using pulp's encrypted field and exposes them in read/write mode via the API instead of marking it as write only...

galaxy-ng (>=4.2.0a3, <=4.6.6), pulp-ansible (>=0.2.0b10, <=0.6.2) potentially affected by CVE-2023-5189 via galaxy-importer (>=0.1.1, <=0.4.9)

galaxy-importer PYPI version =0.1.1, =4.2.0a3, =0.2.0b10, =0.6.2 Source cves: CVE-2023-5189 Source advisory: OSV:GHSA-55G2-VM3Q-7W52...

galaxy-ng (>=4.2.0a3, <=4.6.6), pulp-ansible (>=0.2.0b10, <=0.6.2) potentially affected by CVE-2023-5189 via galaxy-importer (>=0.1.1, <=0.4.9)

galaxy-importer PYPI version =0.1.1, =4.2.0a3, =0.2.0b10, =0.6.2 Source cves: CVE-2023-5189 Source advisory: GHSA-55G2-VM3Q-7W52...

Pulp: Tokens stored in plaintext

A flaw exists in the collection remote for pulpansible, where tokens are stored in plaintext instead of using pulp's encrypted field. This flaw allows an attacker with sufficient privileges to read the stored tokens, resulting in the loss of confidentiality...

Information Disclosure

pulp-ansible is vulnerable to Information Disclosure. The vulnerability exists because the requirementsfile parameter in models.py stores tokens in plain text instead of using pulp's encrypted field, allowing an attacker to modify tokens via the API...