PYSEC-2026-1123
Ansible-Core vulnerable to content protections bypass
At a glance
- Published
- Updated
- CVE
- CVE-2024-11079
- Aliases
- GHSA-99w6-3xph-cx78
- CVSS_V3
- CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L
- CVSS_V4
- CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P
Description
A flaw was found in Ansible-Core. This vulnerability allows attackers to bypass unsafe content protections using the hostvars object to reference and execute templated content. This issue can lead to arbitrary code execution if remote data or module outputs are improperly templated within playbooks.
Affected packages
| Package | Versions |
|---|---|
| PyPI · ansible-core | introduced 0, fixed 2.16.14rc1, introduced 2.17.0b1, fixed 2.17.7rc1, introduced 2.18.0b1, fixed 2.18.1rc1 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2024-11079 ADVISORY
- https://github.com/ansible/ansible/pull/84299 WEB
- https://github.com/ansible/ansible/pull/84339 WEB
- https://github.com/ansible/ansible/commit/2936b80dbbc7efb889934aeec80f6142c10266ce WEB
- https://github.com/ansible/ansible/commit/70e83e72b43e05e57eb42a6d52d01a4d9768f510 WEB
- https://github.com/ansible/ansible/commit/98774d15d7748ebaaaf2e83942cc7e8d39f7280e WEB
- https://access.redhat.com/errata/RHSA-2024:10770 WEB
- https://access.redhat.com/errata/RHSA-2024:11145 WEB
- https://access.redhat.com/security/cve/CVE-2024-11079 WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=2325171 WEB
- https://github.com/ansible/ansible PACKAGE
- https://github.com/ansible/ansible/blob/v2.18.1/changelogs/CHANGELOG-v2.18.rst#security-fixes WEB
- https://lists.debian.org/debian-lts-announce/2026/03/msg00006.html WEB
- https://pypi.org/project/ansible-core PACKAGE
- https://github.com/advisories/GHSA-99w6-3xph-cx78 ADVISORY
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — PyPA Advisory Database |