Bug 2544603 (CVE-2026-103869)

Summary: CVE-2026-103869 pulp-ansible: Bearer tokens are reused across remotes in a worker
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: anthomas, dschmidt, ehelms, ggainey, ikhan, jlanda, jmitchel, jpasqual, juwatts, kshier, mdellweg, mhulan, nmoumoul, osousa, pcreech, rbobbitt, rchan, security-response-team, simaishi, smallamp, stcannon, tmalecek, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in pulp-ansible's bearer-token refresh for collection remotes. The access token is kept in one module-level variable and reused for every token download in that worker. A user who can sync an Ansible remote that uses token refresh, and can point that remote at a server they control, receives an access token obtained for a different remote, and can reuse it at the service that issued it. Content stored in Pulp is not changed, and the service is not stopped.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-01 12:19:52 UTC 
AUTH_TOKEN in pulp_ansible/app/downloaders.py is a module global. TokenAuthHttpDownloader.get_or_update_token() returns that global to any downloader in the process. It is not stored per remote or per token URL. The refresh path runs only when the remote has both token and auth_url. A worker that has already refreshed one remote's token sends that access token as the bearer for a later remote. The collection remote token field is write-only. Introduced by 57f5775b, first release 0.6.0. It has same root cause as reported pulp_container finding (CVE-2026-103868). This is a separate CVE from the pulp-container, as it has different codebase, and independently fixable.