ansible before versions 2.8.6, 2.7.14, 2.6.20 is vulnerable to a None
Priority LOW 32CWE-287Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Partial Red Hat: 8 fixed, 6 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-287.
Summary
ansible before versions 2.8.6, 2.7.14, 2.6.20 is vulnerable to a None
Why it matters now
EPSS 0.01649 76th percentileScored 2026-11-07
Fix Partial ansible (PyPI): 2.8.6, 2.7.14, 2.6.20Red Hat: 5 advisoriesRed Hat: 8 fixed, 6 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| [UNKNOWN] | ansible | 2.8.6; 2.7.14; 2.6.20 | — | No fix listed | CNA |
| — | ansible (PyPI) | 2.8.0 to before 2.8.6 | 2.8.6 | Patch available | GHSA-6fq2-x65v-v9h7 |
| — | ansible (PyPI) | 2.7.0 to before 2.7.14 | 2.7.14 | Patch available | GHSA-6fq2-x65v-v9h7 |
| — | ansible (PyPI) | 2.6.0 to before 2.6.20 | 2.6.20 | Patch available | GHSA-6fq2-x65v-v9h7 |
- ansible Vendor[UNKNOWN] Affected 2.8.6; 2.7.14; 2.6.20 Fixed in — No fix listed CNA
- ansible (PyPI) Vendor— Affected 2.8.0 to before 2.8.6 Fixed in 2.8.6 Patch available GHSA-6fq2-x65v-v9h7
- ansible (PyPI) Vendor— Affected 2.7.0 to before 2.7.14 Fixed in 2.7.14 Patch available GHSA-6fq2-x65v-v9h7
- ansible (PyPI) Vendor— Affected 2.6.0 to before 2.6.20 Fixed in 2.6.20 Patch available GHSA-6fq2-x65v-v9h7
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:redhat:ansible:*:*:*:*:*:*:*:* | 2.6.0 to before 2.6.20; 2.7.0 to before 2.7.14; 2.8.0 to before 2.8.6 | Vulnerable | Red Hat |
| cpe:2.3:a:opensuse:backports_sle:15.0:sp1:*:*:*:*:*:* | 15.0 sp1 | Vulnerable | openSUSE |
| cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* | 15.1 | Vulnerable | openSUSE |
| cpe:2.3:a:redhat:openstack:13:*:*:*:*:*:*:* | 13 | Vulnerable | Red Hat |
- cpe:2.3:a:redhat:ansible:*:*:*:*:*:*:*:* Versions 2.6.0 to before 2.6.20; 2.7.0 to before 2.7.14; 2.8.0 to before 2.8.6 Vulnerable ·Red Hat
- cpe:2.3:a:opensuse:backports_sle:15.0:sp1:*:*:*:*:*:* Versions 15.0 sp1 Vulnerable ·openSUSE
- cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* Versions 15.1 Vulnerable ·openSUSE
- cpe:2.3:a:redhat:openstack:13:*:*:*:*:*:*:* Versions 13 Vulnerable ·Red Hat
Remediation
- Fix · GHSA-6fq2-x65v-v9h7 ansible (PyPI) Fixed in 2.8.6 Advisory →
- Fix · GHSA-6fq2-x65v-v9h7 ansible (PyPI) Fixed in 2.7.14 Advisory →
- Fix · GHSA-6fq2-x65v-v9h7 ansible (PyPI) Fixed in 2.6.20 Advisory →
Red Hat 5 advisories
- RHSA-2020:0756 Released 2020-03-10 · Red Hat rating Moderateansible security update
- Red Hat OpenStack Platform 13.0 ansible-2.6.20-1.el7ae
- Red Hat OpenStack Platform 13.0 for RHEL 7.6 EUS Server ansible-2.6.20-1.el7ae
- RHSA-2019:3201 Released 2019-10-24 · Red Hat rating ImportantAnsible security update
- Red Hat Ansible Engine 2.6 for RHEL 7 Server ansible-2.6.20-1.el7ae
- RHSA-2019:3203 Released 2019-10-24 · Red Hat rating ImportantAnsible security and bug fix update
- Red Hat Ansible Engine 2.8 for RHEL 7 Server ansible-2.8.6-1.el7ae
- Red Hat Ansible Engine 2.8 for RHEL 8 ansible-2.8.6-1.el8ae
Show 2 more Red Hat advisories
- RHSA-2019:3207 Released 2019-10-24 · Red Hat rating ImportantAnsible security and bug fix update
- Red Hat Ansible Engine 2 for RHEL 7 ansible-2.8.6-1.el7ae
- Red Hat Ansible Engine 2 for RHEL 8 ansible-2.8.6-1.el8ae
- RHSA-2019:3202 Released 2019-10-24 · Red Hat rating ImportantAnsible security and bug fix update
- Red Hat Ansible Engine 2.7 for RHEL 7 Server ansible-2.7.14-1.el7ae
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Ceph Storage 2 | Affected | No fix planned: Will not fix |
| Red Hat Ceph Storage 3 | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 10 (Newton) | Affected | No fix planned: Out of support scope |
| Red Hat OpenStack Platform 14 (Rocky) | Affected | No fix planned: Will not fix |
| Red Hat Satellite 6 | Affected | No fix planned: Out of support scope |
| Red Hat Storage 3 | Affected | No fix planned: Will not fix |
| Red Hat Ansible Engine 2 for RHEL 7 | Fixed | RHSA-2019:3207 |
| Red Hat Ansible Engine 2 for RHEL 8 | Fixed | RHSA-2019:3207 |
| Red Hat Ansible Engine 2.6 for RHEL 7 Server | Fixed | RHSA-2019:3201 |
| Red Hat Ansible Engine 2.7 for RHEL 7 Server | Fixed | RHSA-2019:3202 |
| Red Hat Ansible Engine 2.8 for RHEL 7 Server | Fixed | RHSA-2019:3203 |
| Red Hat Ansible Engine 2.8 for RHEL 8 | Fixed | RHSA-2019:3203 |
| Red Hat OpenStack Platform 13.0 | Fixed | RHSA-2020:0756 |
| Red Hat OpenStack Platform 13.0 for RHEL 7.6 EUS Server | Fixed | RHSA-2020:0756 |
Not affected: 1 product
- CloudForms Management Engine 5
Timeline
- 2026-10-02 Threatist record created from CVE-2019-14856
- 2026-10-03 Alias added: GHSA-6fq2-x65v-v9h7
References
Advisory 5
Other 7
- https://github.com/ansible/ansible/pull/63351
- https://github.com/ansible/ansible/commit/16684f118715a52e1c46d437652add9ca36423de
- https://github.com/ansible/ansible/commit/2cbd8775ca1271195169f62122df1f88b532e74f
- https://github.com/ansible/ansible/commit/40618d70e61af1123907a5fb246cc4fd35f1e5c3
- https://github.com/ansible/ansible/commit/7f4befdea77045fa83b5f2b304bd5e16b219f74c
- https://github.com/ansible/ansible
- https://github.com/pypa/advisory-database/tree/main/vulns/ansible/PYSEC-2019-146.yaml
Sources
- CVE-2019-14856 · CVE Program
- CVE-2019-14856 · NVD
- FIRST EPSS
- GHSA-6fq2-x65v-v9h7 · GitHub Advisory Database · CC BY 4.0
- CVE-2019-14856 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences