Description
A flaw was found in Ansible-Core. This vulnerability allows attackers to bypass unsafe content protections using the hostvars object to reference and execute templated content. This issue can lead to arbitrary code execution if remote data or module outputs are improperly templated within playbooks.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | ansible-core | ≤ 2.18.0 | — |
| Red Hat | Ansible Automation Platform Execution Environments | — | — |
| Red Hat | Red Hat Ansible Automation Platform 2.5 for RHEL 8 | — | — |
| Red Hat | Red Hat Ansible Automation Platform 2.5 for RHEL 9 | — | — |
| Red Hat | Red Hat Enterprise Linux 10 | — | — |
| Red Hat | Red Hat Enterprise Linux AI (RHEL AI) | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | ansible | 5.4.0-1 | — |
| Debian 14 | ansible-core | 2.18.0-2 | — |
| Debian 13 | ansible | 5.4.0-1 | — |
| Debian 13 | ansible-core | 2.18.0-2 | — |
| Debian 12 | ansible | 5.4.0-1 | — |
| Debian 12 | ansible-core | 2.14.18-0+deb12u1 | — |
| Debian 11 | ansible | 2.10.7+merged+base+2.10.17+dfsg-0+deb11u4 | DLA-4502-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | ansible +1 | No fix yet | — |
| Ubuntu 26.04 LTS | ansible +1 | No fix yet | — |
| Ubuntu 25.10 | ansible +1 | No fix yet | — |
| Ubuntu 24.04 LTS | ansible +1 | No fix yet | — |
| Ubuntu 22.04 LTS | ansible-core | No fix yet | — |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 22.04 LTS | ansible | No fix yet | — |
| Ubuntu Pro 20.04 LTS | ansible | No fix yet | — |
| Ubuntu Pro 18.04 LTS | ansible | No fix yet | — |
| Ubuntu Pro 16.04 LTS | ansible | No fix yet | — |
| Ubuntu Pro 14.04 LTS | ansible | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Ansible Automation Platform Inside 2 | ansible-core | 1:2.16.14-1.el8ap | RHSA-2024:11145 |
| Red Hat Ansible Automation Platform Developer 2 | ansible-core | 1:2.16.14-1.el8ap | RHSA-2024:11145 |
| Red Hat Ansible Automation Platform 2 | ansible-core | 1:2.16.14-1.el8ap | RHSA-2024:11145 |
| Red Hat Ansible Automation Platform 2 | automation-gateway-server | 2.5.20241218-1.el8ap | RHSA-2024:11145 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | ansible-core | 2.18.1-1.1 | openSUSE-SU-2024:14545-1 |
| openSUSE Tumbleweed | ansible-core-2.16 | 2.16.14-1.1 | openSUSE-SU-2024:14546-1 |
| openSUSE Tumbleweed | ansible-core-2.17 | 2.17.7-1.1 | openSUSE-SU-2024:14547-1 |
| openSUSE Tumbleweed | ansible-core-2.18 | 2.18.10-2.1 | openSUSE-SU-2025:15638-1 |
| openSUSE Tumbleweed | ansible-core-2.19 | 2.19.4-1.1 | openSUSE-SU-2025:15754-1 |
| openSUSE Tumbleweed | ansible-core-2.20 | 2.20.6-1.1 | openSUSE-SU-2026:10945-1 |
| openSUSE Tumbleweed | ansible-core-2.21 | 2.21.6-1.1 | openSUSE-SU-2026:12451-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | ansible-core +1 | 2.15.3-1.amzn2023.0.7 | ALAS2023-2025-860 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | py3-ansible-core +2 | 2.18.1-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | ansible-core | >= 2.18.0b1, < 2.18.1rc1 | 2.18.1rc1 | GHSA-99w6-3xph-cx78 |
| PyPI | ansible-core | >= 2.17.0b1, < 2.17.7rc1 | 2.17.7rc1 | GHSA-99w6-3xph-cx78 |
| PyPI | ansible-core | < 2.16.14rc1 | 2.16.14rc1 | GHSA-99w6-3xph-cx78 |
| PyPI | ansible-core | < 2.16.14rc1 · >= 2.17.0b1, < 2.17.7rc1 · >= 2.18.0b1, < 2.18.1rc1 | 2.16.14rc1, 2.17.7rc1, 2.18.1rc1 | PYSEC-2026-1123 |
Advisories 11
- openSUSE-SU-2026:12451-1 ansible-core-2.21-2.21.6-1.1 on GA media SUSE / openSUSE Security Updates · Nov 7, 2026
- RHSA-2024:11145 Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update Red Hat Security Advisories (RHSA) · Jun 30, 2026
- WID-SEC-2024-3404 Ansible-Core: Schwachstelle ermöglicht Codeausführung BSI CERT-Bund (WID) · Jun 7, 2026
- openSUSE-SU-2026:10945-1 ansible-core-2.20-2.20.6-1.1 on GA media SUSE / openSUSE Security Updates · Jun 4, 2026
- DLA-4502-1 ansible - security update Debian Security (DSA / DLA) · Mar 23, 2026
- openSUSE-SU-2025:15638-1 ansible-core-2.18-2.18.10-2.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- openSUSE-SU-2024:14545-1 ansible-core-2.18.1-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:14547-1 ansible-core-2.17-2.17.7-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:14546-1 ansible-core-2.16-2.16.14-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2025:15754-1 ansible-core-2.19-2.19.4-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- ALAS2023-2025-860 Moderate: ansible-core security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Feb 21, 2025
References
- RHSA-2024:10770 vendor-advisory
- RHSA-2024:11145 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2024-11079 vdb-entry
- RHBZ#2325171 issue-tracking