Description

A flaw was found in the OCAPI modules (ocapi_command, ocapi_info) of the community.general Ansible collection. The shared OCAPI request helper disables TLS certificate validation on every request and the modules expose no parameter to re-enable it, while sending HTTP Basic-Auth credentials to an https endpoint. An attacker positioned on the network path between the Ansible controller and the OCAPI-managed storage/enclosure device can present any certificate, intercept the session, capture the credentials, and tamper with responses.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.8",
  "pubDate": "2026-09-09T17:17:52.960Z",
  "pubdate": "2026-09-09T17:17:52.960Z",
  "executiveSummary": "The community.general Ansible collection is affected by a critical security flaw involving the improper implementation of TLS certificate validation within the OCAPI modules (ocapi_command and ocapi_info). The shared OCAPI request helper explicitly disables certificate verification for all HTTPS communications, providing no configuration mechanism for administrators to enforce secure validation.\nThis vulnerability exposes HTTP Basic-Auth credentials and sensitive management traffic to potential interception. An attacker positioned as a Man-in-the-Middle (MitM) between the Ansible controller and the target storage or enclosure device can forge TLS certificates to intercept the encrypted session. By bypassing certificate validation, the system fails to establish a trusted channel, allowing for the exfiltration of authentication credentials and the manipulation of device configurations.\nThe risk is categorized as high due to the exposure of authentication tokens and the potential for unauthorized administrative access to storage infrastructure. Exploitation requires network positioning along the path of communication between the management host and the target device, enabling full decryption and modification of the command-and-control traffic.",
  "technicalDetails": "The root cause of this vulnerability lies in the design of the shared OCAPI request helper used by the ocapi_command and ocapi_info modules within the community.general Ansible collection. During the initialization of HTTP requests to the target OCAPI-managed storage or enclosure devices, the helper function enforces a 'verify=False' parameter or its equivalent within the underlying networking library. This configuration suppresses the validation of the server's X.509 certificate chain, effectively ignoring the authenticity of the remote endpoint.\nThe vulnerability is compounded by the reliance on HTTP Basic-Auth for authentication. When the Ansible controller initiates a request, it embeds the plaintext-equivalent credentials within the HTTP headers. Because the TLS tunnel is not cryptographically bound to a trusted certificate, an attacker situated on the network path—such as in a shared enterprise network or through ARP spoofing—can initiate an interception. When the Ansible controller attempts to connect, the attacker presents a malicious certificate. Due to the lack of validation, the controller silently accepts the untrusted certificate, establishing the connection with the attacker instead of the intended target device.\nThe exploitation flow proceeds as follows: First, the attacker positions themselves as a transparent proxy or MitM node. Second, the Ansible controller makes a request to the OCAPI service. Third, the attacker intercepts the initial TLS handshake and presents a self-signed or forged certificate. Fourth, the OCAPI module, due to the hardcoded bypass, fails to detect the discrepancy and proceeds to transmit the session credentials and management commands over the compromised link. Finally, the attacker captures the Basic-Auth headers and the structured OCAPI commands, allowing them to perform unauthorized management operations, extract sensitive system data, or inject malicious payloads into the management stream. This post-exploitation impact allows for complete administrative compromise of the target storage hardware, as the attacker can masquerade as the legitimate management interface."
}