CVE-2026-87872

1th percentile - higher than 1% of all known CVEs

A flaw was found in the OCAPI modules (ocapi_command, ocapi_info) of the community.general Ansible collection. The shared OCAPI request helper disables TLS certificate validation on every request and the modules expose no parameter to re-enable it, while sending HTTP Basic-Auth credentials to an https endpoint. An attacker positioned on the network path between the Ansible controller and the OCAPI-managed storage/enclosure device can present any certificate, intercept the session, capture the credentials, and tamper with responses.

An attacker could intercept administrative credentials and tamper with communications to managed devices, potentially leading to unauthorized access and data integrity compromise.

Update the community.general collection to a version that allows enabling TLS certificate validation, and consider using secure communication channels.