Description
A template injection flaw was found in Ansible where a user's controller internal templating operations may remove the unsafe designation from template data. This issue could allow an attacker to use a specially crafted file to introduce templating injection when supplying templating data.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat Ansible Automation Platform 2.4 for RHEL 8 | — | — |
| Red Hat | Red Hat Ansible Automation Platform 2.4 for RHEL 9 | — | — |
| Red Hat | Red Hat Ansible Automation Platform 1.2 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | ansible | 5.4.0-1 | — |
| Debian 14 | ansible-core | 2.14.13-1 | — |
| Debian 13 | ansible | 5.4.0-1 | — |
| Debian 13 | ansible-core | 2.14.13-1 | — |
| Debian 12 | ansible | 5.4.0-1 | — |
| Debian 12 | ansible-core | 2.14.16-0+deb12u1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | ansible-core | No fix yet | — |
| Ubuntu 26.04 LTS | ansible-core | No fix yet | — |
| Ubuntu 25.10 | ansible-core | No fix yet | — |
| Ubuntu 24.04 LTS | ansible-core | No fix yet | — |
| Ubuntu 22.04 LTS | ansible-core | No fix yet | — |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 22.04 LTS | ansible | 2.10.7+merged+base+2.10.8+dfsg-1ubuntu0.1~esm4 | USN-6846-1 |
| Ubuntu Pro 20.04 LTS | ansible | 2.9.6+dfsg-1ubuntu0.1~esm2 | USN-6846-1 |
| Ubuntu Pro 18.04 LTS | ansible | 2.5.1+dfsg-1ubuntu0.1+esm2 | USN-6846-1 |
| Ubuntu Pro 16.04 LTS | ansible | 2.0.0.2-2ubuntu1.3+esm2 | USN-6846-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Ansible Automation Platform Inside 2 | ansible-core | 1:2.15.8-1.el8ap | RHSA-2023:7773 |
| Red Hat Ansible Automation Platform Developer 2 | ansible-core | 1:2.15.8-1.el8ap | RHSA-2023:7773 |
| Red Hat Ansible Automation Platform 2 | ansible-core | 1:2.15.8-1.el8ap | RHSA-2023:7773 |
| Red Hat Ansible Automation Platform 2 | python-galaxy-importer +1 | 0.4.18-1.el9ap | RHSA-2023:7773 |
| Red Hat Ansible Automation Platform 2 | python39-galaxy-importer +1 | 0.4.18-1.el8ap | RHSA-2023:7773 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP5 | golang-github-prometheus-promu | 0.14.0-150000.3.18.2 | SUSE-SU-2024:1509-1 |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Manager Proxy Module 4.3 | ansible | 2.9.27-150000.1.17.2 | SUSE-SU-2024:1509-1 |
| SUSE Manager Proxy Module 4.3 | uyuni-proxy-systemd-services | 4.3.12-150000.1.21.2 | SUSE-SU-2024:1509-1 |
| SUSE Manager Client Tools for SLE Micro 5 | dracut-saltboot | 0.1.1710765237.46af599-150000.1.53.2 | SUSE-SU-2024:1509-1 |
| SUSE Manager Client Tools for SLE Micro 5 | uyuni-proxy-systemd-services | 4.3.12-150000.1.21.2 | SUSE-SU-2024:1509-1 |
| SUSE Manager Client Tools Beta for SLE Micro 5 | golang-github-prometheus-node_exporter | 1.5.0-159000.6.2.1 | SUSE-SU-2024:1427-1 |
| SUSE Manager Client Tools Beta for SLE Micro 5 | uyuni-tools | 0.1.7-159000.3.8.1 | SUSE-SU-2024:1427-1 |
| SUSE Manager Client Tools 15 | POS_Image-JeOS7 +1 | 0.1.1710765237.46af599-150000.1.21.2 | SUSE-SU-2024:1509-1, SUSE-SU-2024:1427-1 |
| SUSE Manager Client Tools 15 | ansible | 2.9.27-150000.1.17.2 | SUSE-SU-2024:1509-1, SUSE-SU-2024:1427-1 |
| SUSE Manager Client Tools 15 | dracut-saltboot | 0.1.1710765237.46af599-150000.1.53.2 | SUSE-SU-2024:1509-1, SUSE-SU-2024:1427-1 |
| SUSE Manager Client Tools 15 | grafana | 9.5.16-159000.4.30.2 | SUSE-SU-2024:1509-1, SUSE-SU-2024:1427-1 |
| SUSE Manager Client Tools 15 | mgr-daemon | 4.3.9-150000.1.47.2 | SUSE-SU-2024:1509-1 |
| SUSE Manager Client Tools 15 | spacecmd | 4.3.27-150000.3.116.2 | SUSE-SU-2024:1509-1, SUSE-SU-2024:1427-1 |
| SUSE Manager Client Tools 15 | spacewalk-client-tools | 4.3.19-150000.3.89.2 | SUSE-SU-2024:1509-1, SUSE-SU-2024:1427-1 |
| SUSE Manager Client Tools 15 | spacewalk-koan | 4.3.6-150000.3.33.2 | SUSE-SU-2024:1509-1 |
| SUSE Manager Client Tools 15 | supportutils-plugin-susemanager-client | 5.0.3-159000.6.21.2 | SUSE-SU-2024:1427-1 |
| SUSE Manager Client Tools 15 | uyuni-common-libs | 4.3.10-150000.1.39.2 | SUSE-SU-2024:1509-1 |
| SUSE Manager Client Tools 15 | uyuni-proxy-systemd-services | 4.3.12-150000.1.21.2 | SUSE-SU-2024:1509-1 |
| SUSE Manager Client Tools 15 | uyuni-tools | 0.1.7-159000.3.8.1 | SUSE-SU-2024:1427-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | ansible-core | 2.16.9-1.1 | openSUSE-SU-2024:14251-1 |
| openSUSE Tumbleweed | ansible-core-2.17 | 2.17.6-1.1 | openSUSE-SU-2024:14537-1 |
| openSUSE Tumbleweed | ansible-core-2.18 | 2.18.10-2.1 | openSUSE-SU-2025:15638-1 |
| openSUSE Tumbleweed | ansible-core-2.19 | 2.19.4-1.1 | openSUSE-SU-2025:15754-1 |
| openSUSE Tumbleweed | ansible-core-2.20 | 2.20.6-1.1 | openSUSE-SU-2026:10945-1 |
| openSUSE Tumbleweed | ansible-core-2.21 | 2.21.6-1.1 | openSUSE-SU-2026:12451-1 |
| openSUSE Tumbleweed | ansible-documentation | 2.15.7-1.1 | openSUSE-SU-2024:13486-1 |
| openSUSE Leap 15.5 | POS_Image-JeOS7 +1 | 0.1.1710765237.46af599-150000.1.21.2 | SUSE-SU-2024:1509-1 |
| openSUSE Leap 15.5 | ansible | 2.9.27-150000.1.17.2 | SUSE-SU-2024:1509-1 |
| openSUSE Leap 15.5 | dracut-saltboot | 0.1.1710765237.46af599-150000.1.53.2 | SUSE-SU-2024:1509-1 |
| openSUSE Leap 15.5 | golang-github-prometheus-promu | 0.14.0-150000.3.18.2 | SUSE-SU-2024:1509-1 |
| openSUSE Leap 15.5 | spacecmd | 4.3.27-150000.3.116.2 | SUSE-SU-2024:1509-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | ansible-core +1 | 2.15.3-1.amzn2023.0.2 | ALAS2023-2024-465 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | ansible | 2.17.0-1 | — |
| Azure Linux 2 (CBL-Mariner) | ansible | 2.14.12-2 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | ansible-core | >= 2.16.0, < 2.16.1 | 2.16.1 | GHSA-7j69-qfc3-2fq9 |
| PyPI | ansible-core | >= 2.15.0, < 2.15.8 | 2.15.8 | GHSA-7j69-qfc3-2fq9 |
| PyPI | ansible-core | < 2.14.12 | 2.14.12 | GHSA-7j69-qfc3-2fq9 |
| PyPI | ansible-core | < 2.14.12 · >= 2.15.0, < 2.15.8 · >= 2.16.0, < 2.16.1 | 2.14.12, 2.15.8, 2.16.1 | PYSEC-2026-1122 |
Advisories 16
- openSUSE-SU-2026:12451-1 ansible-core-2.21-2.21.6-1.1 on GA media SUSE / openSUSE Security Updates · Nov 7, 2026
- RHSA-2023:7773 Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- USN-6846-1 ansible vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
- WID-SEC-2023-2816 Red Hat Ansible Automation Platform: Schwachstelle ermöglicht Codeausführung BSI CERT-Bund (WID) · Jun 7, 2026
- openSUSE-SU-2026:10945-1 ansible-core-2.20-2.20.6-1.1 on GA media SUSE / openSUSE Security Updates · Jun 4, 2026
- openSUSE-SU-2025:15638-1 ansible-core-2.18-2.18.10-2.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2024:1509-1 Security update for SUSE Manager Client Tools SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:14251-1 ansible-core-2.16-2.16.9-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:1427-1 Security Beta update for SUSE Manager Client Tools and Salt SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:13486-1 ansible-documentation-2.15.7-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2025:15754-1 ansible-core-2.19-2.19.4-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:14537-1 ansible-core-2.17-2.17.6-1.1 on GA media SUSE / openSUSE Security Updates · May 7, 2025
- WID-SEC-2024-1248 Xerox FreeFlow Print Server: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 21, 2024
- NCSC-2024-0305 Kwetsbaarheden verholpen in Oracle Siebel CRM NCSC-NL (Netherlands) · Jul 17, 2024
- WID-SEC-2024-1653 Oracle Siebel CRM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 16, 2024
- ALAS2023-2024-465 Moderate: ansible-core security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jan 8, 2024
References
- RHSA-2023:7773 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2023-5764 vdb-entry
- RHBZ#2247629 issue-tracking