CVE-2026-103869 in Ansible Automation Platform
Summary
by MITRE • 10/07/2026
A flaw was found in pulp-ansible's bearer-token refresh for collection remotes. The access token is kept in one module-level variable and reused for every token download in that worker. A user who can sync an Ansible remote that uses token refresh, and can point that remote at a server they control, receives an access token obtained for a different remote, and can reuse it at the service that issued it. Content stored in Pulp is not changed, and the service is not stopped.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/07/2026
The vulnerability identified within pulp-ansible represents a critical authentication bypass flaw rooted in improper state management of bearer tokens during collection synchronization operations. Specifically, the defect lies in how access tokens are cached and reused across different remote configurations within the same worker process. The system maintains an access token in a single module-level variable rather than isolating it per remote or session context. This architectural oversight means that when a user initiates a sync operation for an Ansible remote configured with token refresh capabilities, the authentication logic does not strictly validate whether the cached token corresponds to the intended target server. Instead, if a valid token exists in memory from a previous interaction, even one associated with a different remote or service context, it may be erroneously reused or overwritten by tokens obtained for other remotes under specific conditions. This behavior creates a scenario where authentication credentials are not properly scoped to their originating identity provider or target endpoint, leading to potential cross-context token leakage and misuse.
From an operational perspective, this flaw allows an attacker with the ability to sync Ansible content through pulp-ansible to manipulate the authentication flow by pointing a remote configuration at a server under their control. By doing so, the attacker can trigger the retrieval of access tokens that are subsequently stored in the shared module-level variable. Because the system fails to enforce strict separation between different remote contexts within the same worker process, these tokens may be retained or reused in ways that allow them to be presented back to the issuing service as valid credentials for unauthorized purposes. Although the vulnerability does not result in direct modification of content stored within Pulp nor cause a denial of service by stopping the service, it effectively compromises the integrity of the authentication mechanism. The attacker gains the ability to reuse tokens obtained for one remote context against other services or endpoints that trust those same issuing authorities, potentially leading to unauthorized access to protected resources or further lateral movement within the infrastructure relying on these identity providers.
This vulnerability aligns with CWE-284 Improper Access Control and CWE-798 Use of Hard-coded Credentials in terms of improper handling of dynamic credentials, as well as CWE-613 Insufficient Session Expiration when considering the reuse of tokens beyond their intended scope. In the context of the MITRE ATT&CK framework, this behavior facilitates Credential Access techniques such as T1528 Steal Application Access Token and potentially T1078 Valid Accounts if the reused token grants access to additional systems or services that trust the original issuer. The core issue is a failure in implementing proper isolation boundaries for sensitive security artifacts within multi-tenant or multi-context environments, allowing state leakage between distinct operational contexts managed by the same process instance.
Mitigation strategies must focus on enforcing strict context separation for authentication tokens and ensuring that token caching mechanisms are scoped appropriately to prevent cross-contamination between different remote configurations. Developers should refactor the codebase to store access tokens in a manner that ties them explicitly to their specific remote identifier or session context, rather than using global module-level variables that persist across unrelated operations. Implementing short-lived token lifecycles and ensuring immediate invalidation upon sync completion can also reduce the window of opportunity for exploitation. Additionally, introducing rigorous validation checks before reusing cached tokens would ensure that a token is only applied to its intended target server, thereby preventing attackers from leveraging tokens obtained through manipulated remotes against other services. Updating pulp-ansible to versions where this state management flaw has been corrected is essential for restoring the integrity of authentication flows and protecting against unauthorized access via stolen or misapplied bearer tokens.