Ansible-core: unsafe tagging bypass via hostvars object in ansible-core
Priority LOW 25CWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- Partial Red Hat: 3 fixed, 1 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.
Summary
A flaw was found in Ansible-Core. This vulnerability allows attackers to bypass unsafe content protections using the hostvars object to reference and execute templated content. This issue can lead to arbitrary code execution if remote data or module outputs are improperly templated within playbooks.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00529 44th percentileScored 2026-11-07
Fix Partial ansible-core (PyPI): 2.18.1rc1, 2.17.7rc1, 2.16.14rc1Red Hat: 2 advisoriesRed Hat: 3 fixed, 1 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | ansible-core | up to 2.18.0 | — | No fix listed | CNA |
| Red Hat | Ansible Automation Platform Execution Environments | — | 1.2.0-93 | Patch available | CNA |
| Red Hat | Ansible Automation Platform Execution Environments | — | 3.0.1-108 | Patch available | CNA |
| Red Hat | Ansible Automation Platform Execution Environments | — | 2.9.27-34 | Patch available | CNA |
| Red Hat | Ansible Automation Platform Execution Environments | — | 2.12.10-56 | Patch available | CNA |
| Red Hat | Ansible Automation Platform Execution Environments | — | 2.15.13-4 | Patch available | CNA |
| Red Hat | Red Hat Ansible Automation Platform 2.5 for RHEL 8 | — | 1:2.16.14-1.el8ap | Patch available | CNA |
| Red Hat | Red Hat Ansible Automation Platform 2.5 for RHEL 8 | — | 1:2.16.14-1.el8ap | Patch available | CNA |
| Red Hat | Red Hat Ansible Automation Platform 2.5 for RHEL 8 | — | 1:2.16.14-1.el8ap | Patch available | CNA |
| Red Hat | Red Hat Ansible Automation Platform 2.5 for RHEL 9 | — | 1:2.16.14-1.el9ap | Patch available | CNA |
| Red Hat | Red Hat Ansible Automation Platform 2.5 for RHEL 9 | — | 1:2.16.14-1.el9ap | Patch available | CNA |
| Red Hat | Red Hat Ansible Automation Platform 2.5 for RHEL 9 | — | 1:2.16.14-1.el9ap | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 10 | — | — | Not affected | CNA |
| Red Hat | Red Hat Enterprise Linux AI (RHEL AI) | — | — | No fix listed | CNA |
| Red Hat | Red Hat Enterprise Linux AI (RHEL AI) | — | — | No fix listed | CNA |
| — | ansible-core (PyPI) | 2.18.0b1 to before 2.18.1rc1 | 2.18.1rc1 | Patch available | GHSA-99w6-3xph-cx78 |
| — | ansible-core (PyPI) | 2.17.0b1 to before 2.17.7rc1 | 2.17.7rc1 | Patch available | GHSA-99w6-3xph-cx78 |
| — | ansible-core (PyPI) | before 2.16.14rc1 | 2.16.14rc1 | Patch available | GHSA-99w6-3xph-cx78 |
- ansible-core Vendor— Affected up to 2.18.0 Fixed in — No fix listed CNA
- Ansible Automation Platform Execution Environments VendorRed Hat Affected — Fixed in 1.2.0-93 Patch available CNA
- Ansible Automation Platform Execution Environments VendorRed Hat Affected — Fixed in 3.0.1-108 Patch available CNA
- Ansible Automation Platform Execution Environments VendorRed Hat Affected — Fixed in 2.9.27-34 Patch available CNA
- Ansible Automation Platform Execution Environments VendorRed Hat Affected — Fixed in 2.12.10-56 Patch available CNA
- Ansible Automation Platform Execution Environments VendorRed Hat Affected — Fixed in 2.15.13-4 Patch available CNA
- Red Hat Ansible Automation Platform 2.5 for RHEL 8 VendorRed Hat Affected — Fixed in 1:2.16.14-1.el8ap Patch available CNA
- Red Hat Ansible Automation Platform 2.5 for RHEL 8 VendorRed Hat Affected — Fixed in 1:2.16.14-1.el8ap Patch available CNA
- Red Hat Ansible Automation Platform 2.5 for RHEL 8 VendorRed Hat Affected — Fixed in 1:2.16.14-1.el8ap Patch available CNA
- Red Hat Ansible Automation Platform 2.5 for RHEL 9 VendorRed Hat Affected — Fixed in 1:2.16.14-1.el9ap Patch available CNA
- Red Hat Ansible Automation Platform 2.5 for RHEL 9 VendorRed Hat Affected — Fixed in 1:2.16.14-1.el9ap Patch available CNA
- Red Hat Ansible Automation Platform 2.5 for RHEL 9 VendorRed Hat Affected — Fixed in 1:2.16.14-1.el9ap Patch available CNA
- Red Hat Enterprise Linux 10 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Enterprise Linux AI (RHEL AI) VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Enterprise Linux AI (RHEL AI) VendorRed Hat Affected — Fixed in — No fix listed CNA
- ansible-core (PyPI) Vendor— Affected 2.18.0b1 to before 2.18.1rc1 Fixed in 2.18.1rc1 Patch available GHSA-99w6-3xph-cx78
- ansible-core (PyPI) Vendor— Affected 2.17.0b1 to before 2.17.7rc1 Fixed in 2.17.7rc1 Patch available GHSA-99w6-3xph-cx78
- ansible-core (PyPI) Vendor— Affected before 2.16.14rc1 Fixed in 2.16.14rc1 Patch available GHSA-99w6-3xph-cx78
CPE names CNA · 10
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:/a:redhat:ansible_core:2::el8 | 2 | — | Red Hat |
| cpe:/a:redhat:ansible_core:2::el9 | 2 | — | Red Hat |
| cpe:/a:redhat:ansible_automation_platform:2.5::el8 | 2.5 | — | Red Hat |
| cpe:/a:redhat:ansible_automation_platform:2.5::el9 | 2.5 | — | Red Hat |
| cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8 | 2.5 | — | Red Hat |
| cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9 | 2.5 | — | Red Hat |
| cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8 | 2.5 | — | Red Hat |
| cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9 | 2.5 | — | Red Hat |
| cpe:/a:redhat:enterprise_linux:10 | 10 | — | Red Hat |
| cpe:/a:redhat:enterprise_linux_ai:1 | 1 | — | Red Hat |
- cpe:/a:redhat:ansible_core:2::el8 Versions 2 — ·Red Hat
- cpe:/a:redhat:ansible_core:2::el9 Versions 2 — ·Red Hat
- cpe:/a:redhat:ansible_automation_platform:2.5::el8 Versions 2.5 — ·Red Hat
- cpe:/a:redhat:ansible_automation_platform:2.5::el9 Versions 2.5 — ·Red Hat
- cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8 Versions 2.5 — ·Red Hat
- cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9 Versions 2.5 — ·Red Hat
- cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8 Versions 2.5 — ·Red Hat
- cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9 Versions 2.5 — ·Red Hat
- cpe:/a:redhat:enterprise_linux:10 Versions 10 — ·Red Hat
- cpe:/a:redhat:enterprise_linux_ai:1 Versions 1 — ·Red Hat
Remediation
- Fix · GHSA-99w6-3xph-cx78 ansible-core (PyPI) Fixed in 2.18.1rc1 Advisory →
- Fix · GHSA-99w6-3xph-cx78 ansible-core (PyPI) Fixed in 2.17.7rc1 Advisory →
- Fix · GHSA-99w6-3xph-cx78 ansible-core (PyPI) Fixed in 2.16.14rc1 Advisory →
Red Hat 2 advisories
- RHSA-2024:11145 Released 2024-12-16 · Red Hat rating ModerateRed Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update
- Red Hat Ansible Automation Platform 2.5 for RHEL 8 ansible-core-1:2.16.14-1.el8ap, automation-gateway-server-2.5.20241218-1.el8ap
- Red Hat Ansible Automation Platform 2.5 for RHEL 9 ansible-core-1:2.16.14-1.el9ap, automation-gateway-server-2.5.20241218-1.el9ap
- RHSA-2024:10770 Released 2024-12-03 · Red Hat rating ModerateRed Hat Ansible Automation Platform Execution Environments Container Release Update
- Ansible Automation Platform Execution Environments ansible-automation-platform/ansible-builder-rhel8, ansible-automation-platform/ansible-builder-rhel9, ansible-automation-platform/ee-29-rhel8 +2
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux AI (RHEL AI) | Affected | No fix yet: Fix deferred |
| Ansible Automation Platform Execution Environments | Fixed | RHSA-2024:10770 |
| Red Hat Ansible Automation Platform 2.5 for RHEL 8 | Fixed | RHSA-2024:11145 |
| Red Hat Ansible Automation Platform 2.5 for RHEL 9 | Fixed | RHSA-2024:11145 |
Not affected: 3 products
- Red Hat Ansible Automation Platform 2.5 for RHEL 8
- Red Hat Ansible Automation Platform 2.5 for RHEL 9
- Red Hat Enterprise Linux 10
Timeline
- 2026-10-02 Threatist record created from CVE-2024-11079
- 2026-10-03 Alias added: GHSA-99w6-3xph-cx78
- 2026-11-05 Affected versions changed · CNA
References
Other 10
- https://access.redhat.com/security/cve/CVE-2024-11079
- RHBZ#2325171
- https://github.com/ansible/ansible/pull/84299
- https://github.com/ansible/ansible/pull/84339
- https://github.com/ansible/ansible/commit/2936b80dbbc7efb889934aeec80f6142c10266ce
- https://github.com/ansible/ansible/commit/70e83e72b43e05e57eb42a6d52d01a4d9768f510
- https://github.com/ansible/ansible/commit/98774d15d7748ebaaaf2e83942cc7e8d39f7280e
- https://github.com/ansible/ansible
- https://github.com/ansible/ansible/blob/v2.18.1/changelogs/CHANGELOG-v2.18.rst#security-fixes
- https://lists.debian.org/debian-lts-announce/2026/03/msg00006.html
More Red Hat vulnerabilities
- TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
- TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
- TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
- TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
Sources
- CVE-2024-11079 · CVE Program
- CVE-2024-11079 · NVD
- FIRST EPSS
- GHSA-99w6-3xph-cx78 · GitHub Advisory Database · CC BY 4.0
- CVE-2024-11079 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences