OS command injection in Red Hat Ansible
Priority LOW 33CWE-78Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- High
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · Low
- Fix status
- Partial Red Hat: 2 fixed, 7 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-78.
Summary
A flaw was found in the pipe lookup plugin of ansible. Arbitrary commands can be run, when the pipe lookup plugin uses subprocess.Popen() with shell=True, by overwriting ansible facts and the variable is not escaped by quote plugin. An attacker could take advantage and run arbitrary commands by overwriting the ansible facts.
Why it matters now
EPSS 0.00455 39th percentileScored 2026-11-07
Fix Partial ansible (PyPI): 2.10.0rc1, 2.9.11, 2.8.13Red Hat: 2 fixed, 7 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Red Hat | Ansible | all versions | — | No fix listed | CNA |
| — | ansible (PyPI) | 2.10.0a1 to before 2.10.0rc1 | 2.10.0rc1 | Patch available | GHSA-h39q-95q5-9jfp |
| — | ansible (PyPI) | 2.9.0a1 to before 2.9.11 | 2.9.11 | Patch available | GHSA-h39q-95q5-9jfp |
| — | ansible (PyPI) | before 2.8.13 | 2.8.13 | Patch available | GHSA-h39q-95q5-9jfp |
- Ansible VendorRed Hat Affected all versions Fixed in — No fix listed CNA
- ansible (PyPI) Vendor— Affected 2.10.0a1 to before 2.10.0rc1 Fixed in 2.10.0rc1 Patch available GHSA-h39q-95q5-9jfp
- ansible (PyPI) Vendor— Affected 2.9.0a1 to before 2.9.11 Fixed in 2.9.11 Patch available GHSA-h39q-95q5-9jfp
- ansible (PyPI) Vendor— Affected before 2.8.13 Fixed in 2.8.13 Patch available GHSA-h39q-95q5-9jfp
CPE configurations NVD · 7
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:redhat:ansible_engine:*:*:*:*:*:*:*:* | up to 2.7.16 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:ansible_engine:2.8.8:*:*:*:*:*:*:* | 2.8.8 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:ansible_engine:2.9.5:*:*:*:*:*:*:* | 2.9.5 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:ansible_tower:*:*:*:*:*:*:*:* | up to 3.3.4 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:ansible_tower:3.4.5:*:*:*:*:*:*:* | 3.4.5 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:ansible_tower:3.5.5:*:*:*:*:*:*:* | 3.5.5 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:ansible_tower:3.6.3:*:*:*:*:*:*:* | 3.6.3 | Vulnerable | Red Hat |
- cpe:2.3:a:redhat:ansible_engine:*:*:*:*:*:*:*:* Versions up to 2.7.16 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:ansible_engine:2.8.8:*:*:*:*:*:*:* Versions 2.8.8 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:ansible_engine:2.9.5:*:*:*:*:*:*:* Versions 2.9.5 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:ansible_tower:*:*:*:*:*:*:*:* Versions up to 3.3.4 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:ansible_tower:3.4.5:*:*:*:*:*:*:* Versions 3.4.5 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:ansible_tower:3.5.5:*:*:*:*:*:*:* Versions 3.5.5 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:ansible_tower:3.6.3:*:*:*:*:*:*:* Versions 3.6.3 Vulnerable ·Red Hat
Remediation
- Fix · GHSA-h39q-95q5-9jfp ansible (PyPI) Fixed in 2.10.0rc1 Advisory →
- Fix · GHSA-h39q-95q5-9jfp ansible (PyPI) Fixed in 2.9.11 Advisory →
- Fix · GHSA-h39q-95q5-9jfp ansible (PyPI) Fixed in 2.8.13 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Ansible Engine 2 | Affected | No fix planned: Will not fix |
| Red Hat Ansible Tower 3 | Affected | No fix planned: Will not fix |
| Red Hat Ceph Storage 2 | Affected | No fix planned: Out of support scope |
| Red Hat Ceph Storage 3 | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 10 (Newton) | Affected | No fix planned: Out of support scope |
| Red Hat OpenStack Platform 13 (Queens) | Affected | No fix planned: Will not fix |
| Red Hat Storage 3 | Affected | No fix planned: Will not fix |
| Red Hat Ansible Tower 3.4 for RHEL 7 Server | Fixed | — |
| Red Hat Ansible Tower 3.5 for RHEL 7 Server | Fixed | — |
Not affected: 1 product
- CloudForms Management Engine 5
Timeline
- 2026-10-02 Threatist record created from CVE-2020-1734
- 2026-10-03 Alias added: GHSA-h39q-95q5-9jfp
References
Advisory 4
Other 12
- https://github.com/ansible/ansible/issues/70159
- https://github.com/ansible/ansible/pull/70596
- https://github.com/ansible/ansible/commit/4f978af4ca16ad9828ffe42203b9615425195f8b
- https://github.com/ansible/ansible/commit/963bdd9983b91a48fb6949fb2ef41071e72d0be0
- https://github.com/ansible/ansible/commit/bff0724e9eab2770f874e018298f9ab74cc2a78f
- https://github.com/ansible/ansible/commit/e5649ca3e807f17e7c034ee22791f107162973b0
- https://access.redhat.com/errata/RHBA-2020:0547
- https://access.redhat.com/errata/RHBA-2020:1539
- https://access.redhat.com/security/cve/CVE-2020-1734
- https://bugzilla.redhat.com/show_bug.cgi?id=1801804
- https://github.com/ansible/ansible
- https://github.com/pypa/advisory-database/tree/main/vulns/ansible/PYSEC-2020-6.yaml
More Red Hat Ansible Engine vulnerabilities
- TI-2018-05593 transport.py in the SSH server implementation of Paramiko before 1.17.6, 1.18.x before… CVSS 3.1CRITICAL 9.8
- TI-2017-05127 Improper input validation in [UNKNOWN] ansible CVSS 3.1CRITICAL 9.8
- TI-2021-03523 Information disclosure in ansible CVSS 3.1HIGH 7.5
- TI-2019-11051 Sensitive information in log files in Red Hat Ansible CVSS 3.1HIGH 7.8
- TI-2018-07689 Untrusted search path in [UNKNOWN] ansible CVSS 3.1HIGH 7.8
- TI-2018-07688 Untrusted search path in [UNKNOWN] ansible CVSS 3.0HIGH 7.8
Sources
- CVE-2020-1734 · CVE Program
- CVE-2020-1734 · NVD
- FIRST EPSS
- GHSA-h39q-95q5-9jfp · GitHub Advisory Database · CC BY 4.0
- CVE-2020-1734 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences