Read the docs
TI-2018-07688 Aliases CVE-2018-10874GHSA-3xvg-x47j-x75w

Untrusted search path in [UNKNOWN] ansible

Priority LOW 35CWE-426Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 9 fixed, 4 without a fix

Attack profile from CVSS 3.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-426.

Summary

In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attacker's control, allowing to run arbitrary code as a result.

Why it matters now

EPSS 0.00485 42nd percentileScored 2026-11-07
Fix Partial ansible (PyPI): 2.4.6.0, 2.5.6, 2.6.1Red Hat: 7 advisoriesRed Hat: 9 fixed, 4 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
[UNKNOWN]ansibleall versions—No fix listedCNA
—ansible (PyPI)before 2.4.6.02.4.6.0Patch availableGHSA-3xvg-x47j-x75w
—ansible (PyPI)2.5 to before 2.5.62.5.6Patch availableGHSA-3xvg-x47j-x75w
—ansible (PyPI)2.6 to before 2.6.12.6.1Patch availableGHSA-3xvg-x47j-x75w
  • ansible Vendor[UNKNOWN] Affected all versions Fixed in — No fix listed CNA
  • ansible (PyPI) Vendor— Affected before 2.4.6.0 Fixed in 2.4.6.0 Patch available GHSA-3xvg-x47j-x75w
  • ansible (PyPI) Vendor— Affected 2.5 to before 2.5.6 Fixed in 2.5.6 Patch available GHSA-3xvg-x47j-x75w
  • ansible (PyPI) Vendor— Affected 2.6 to before 2.6.1 Fixed in 2.6.1 Patch available GHSA-3xvg-x47j-x75w

CPE configurations NVD · 9

CPEVersionsRoleVendor
cpe:2.3:a:redhat:ansible_engine:2.0:*:*:*:*:*:*:*2.0VulnerableRed Hat
cpe:2.3:a:redhat:ansible_engine:2.4:*:*:*:*:*:*:*2.4VulnerableRed Hat
cpe:2.3:a:redhat:ansible_engine:2.5:*:*:*:*:*:*:*2.5VulnerableRed Hat
cpe:2.3:a:redhat:ansible_engine:2.6:*:*:*:*:*:*:*2.6VulnerableRed Hat
cpe:2.3:a:redhat:openstack:10:*:*:*:*:*:*:*10VulnerableRed Hat
cpe:2.3:a:redhat:openstack:12:*:*:*:*:*:*:*12VulnerableRed Hat
cpe:2.3:a:redhat:openstack:13:*:*:*:*:*:*:*13VulnerableRed Hat
cpe:2.3:a:redhat:virtualization:4.0:*:*:*:*:*:*:*4.0VulnerableRed Hat
cpe:2.3:a:redhat:virtualization_host:4.0:*:*:*:*:*:*:*4.0VulnerableRed Hat
  • cpe:2.3:a:redhat:ansible_engine:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:ansible_engine:2.4:*:*:*:*:*:*:* Versions 2.4 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:ansible_engine:2.5:*:*:*:*:*:*:* Versions 2.5 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:ansible_engine:2.6:*:*:*:*:*:*:* Versions 2.6 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openstack:10:*:*:*:*:*:*:* Versions 10 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openstack:12:*:*:*:*:*:*:* Versions 12 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openstack:13:*:*:*:*:*:*:* Versions 13 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:virtualization:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:virtualization_host:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·Red Hat

Remediation

  • Fix · GHSA-3xvg-x47j-x75w ansible (PyPI) Fixed in 2.4.6.0 Advisory →
  • Fix · GHSA-3xvg-x47j-x75w ansible (PyPI) Fixed in 2.5.6 Advisory →
  • Fix · GHSA-3xvg-x47j-x75w ansible (PyPI) Fixed in 2.6.1 Advisory →

Red Hat 7 advisories

  • RHSA-2019:0054 Released 2019-01-16 · Red Hat rating Moderate
    ansible security update
    • Red Hat OpenStack Platform 10.0 ansible-2.4.6.0-1.el7ae
  • RHSA-2018:2585 Released 2018-08-29 · Red Hat rating Moderate
    ansible security update
    • Red Hat OpenStack Platform 13.0 ansible-2.4.6.0-1.el7ae
  • RHSA-2018:2321 Released 2018-07-31 · Red Hat rating Moderate
    Red Hat Virtualization security, bug fix, and enhancement update
    • RHEL 7-based RHEV-H for RHEV 4 (build requirements) imgbased-1.0.22-1.el7ev, python-imgbased-1.0.22-1.el7ev, redhat-release-virtualization-host-4.2-5.0.el7 +1
    • Red Hat Virtualization 4 Hypervisor for RHEL 7 redhat-virtualization-host-4.2-20180724.0.el7_5, redhat-virtualization-host-image-update-4.2-20180724.0.el7_5
Show 4 more Red Hat advisories
  • RHSA-2018:2166 Released 2018-07-10 · Red Hat rating Moderate
    ansible security and bug fix update
    • Red Hat Ansible Engine 2.6 for RHEL 7 Server ansible-2.6.1-1.el7ae
  • RHSA-2018:2152 Released 2018-07-10 · Red Hat rating Moderate
    ansible security update
    • Red Hat Ansible Engine 2.4 for RHEL 7 Server ansible-2.4.6.0-1.el7ae, ansible-doc-2.4.6.0-1.el7ae
  • RHSA-2018:2151 Released 2018-07-10 · Red Hat rating Moderate
    ansible security and bug fix update
    • Red Hat Ansible Engine 2 for RHEL 7 ansible-2.6.1-1.el7ae
  • RHSA-2018:2150 Released 2018-07-10 · Red Hat rating Moderate
    ansible security and bug fix update
    • Red Hat Ansible Engine 2.5 for RHEL 7 Server ansible-2.5.6-1.el7ae, ansible-doc-2.5.6-1.el7ae

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Ceph Storage 2AffectedNo fix planned: Will not fix
Red Hat Ceph Storage 3AffectedNo fix planned: Will not fix
Red Hat OpenShift Enterprise 3AffectedNo fix planned: Will not fix
Red Hat Storage 3AffectedNo fix planned: Will not fix
RHEL 7-based RHEV-H for RHEV 4 (build requirements)Fixed RHSA-2018:2321
Red Hat Ansible Engine 2 for RHEL 7Fixed RHSA-2018:2151
Red Hat Ansible Engine 2.4 for RHEL 7 ServerFixed RHSA-2018:2152
Red Hat Ansible Engine 2.5 for RHEL 7 ServerFixed RHSA-2018:2150
Red Hat Ansible Engine 2.6 for RHEL 7 ServerFixed RHSA-2018:2166
Red Hat OpenStack Platform 10.0Fixed RHSA-2019:0054
Red Hat OpenStack Platform 12.0Fixed—
Red Hat OpenStack Platform 13.0Fixed RHSA-2018:2585
Red Hat Virtualization 4 Hypervisor for RHEL 7Fixed RHSA-2018:2321
Not affected: 3 products
  • CloudForms Management Engine 5
  • Red Hat OpenStack Platform 14 (Rocky)
  • Red Hat Satellite 6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-10874
  2. 2026-10-03 Alias added: GHSA-3xvg-x47j-x75w

References

Advisory 11

Other 10

  • TI-2018-05593 transport.py in the SSH server implementation of Paramiko before 1.17.6, 1.18.x before… CVSS 3.1CRITICAL 9.8
  • TI-2017-05127 Improper input validation in [UNKNOWN] ansible CVSS 3.1CRITICAL 9.8
  • TI-2021-03523 Information disclosure in ansible CVSS 3.1HIGH 7.5
  • TI-2019-11051 Sensitive information in log files in Red Hat Ansible CVSS 3.1HIGH 7.8
  • TI-2018-07689 Untrusted search path in [UNKNOWN] ansible CVSS 3.1HIGH 7.8
  • TI-2020-01681 Path traversal in Red Hat Ansible CVSS 3.1HIGH 7.8
See all 24 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences