Ansible Arbitrary Code Execution

published 2018-06-22 8 y ago modified 2026-06-17 4 mo ago also GHSA-3m8p-xpm6-8ww3 , PYSEC-2018-40 , EUVD-2018-0013

cvss: 8.0; version 3.0, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 3.0%; EPSS 3.0% chance of exploitation in 30 days, percentile 87%
public exploits: 0; none known

Ansible before version 2.3 has an input validation vulnerability in the handling of data sent from client systems. An attacker with control over a client system being managed by Ansible, and the ability to send facts back to the Ansible server, could use this flaw to execute arbitrary code on the Ansible server using the Ansible server privileges.

Patch / fix

fixed in 2 distros 5 links 2

pypi ansible 2.2.3.0, 2.3.0.0
redhat ansible 2.3

debian ubuntu red hat suse opensuse

ansible Debian 14, Debian 13, Debian 12 2.2.1.0-2

debian advisories DEBIAN-CVE-2017-7466

ansible Ubuntu 16.04 LTS 2.0.0.2-2ubuntu1.1

ubuntu advisories UBUNTU-CVE-2017-7466

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

ansible rhev manager 4 2.3.0.0-4.el7
ansible storage 3.2, rhscon 2, openstack 11 +5 more 2.2.3.0-1.el7
openshift-ansible openshift 3.2 3.2.56-1.git.0.b844ab7.el7
openshift-ansible openshift 3.3 3.3.82-1.git.0.af0c922.el7
openshift-ansible openshift 3.4 3.4.89-1.git.0.ac29ce8.el7
openshift-ansible openshift 3.5 3.5.71-1.git.0.128c2db.el7
atomic-openshift-utils openshift 3.2 3.2.56-1.git.0.b844ab7.el7
atomic-openshift-utils openshift 3.3 3.3.82-1.git.0.af0c922.el7

red hat advisories RHSA-2017:1685 RHSA-2017:1599 RHSA-2017:1476 RHSA-2017:1499 RHSA-2017:1334 RHSA-2017:1244

storm OpenStack Cloud Crowbar 8, OpenStack Cloud 8, HPE Helion OpenStack 8 1.2.3-3.6.1
ansible OpenStack Cloud Crowbar 8, OpenStack Cloud 8, HPE Helion OpenStack 8 2.9.14-3.15.1
grafana OpenStack Cloud Crowbar 8, OpenStack Cloud 8, HPE Helion OpenStack 8 6.7.4-4.12.1
ardana-mq OpenStack Cloud 8, HPE Helion OpenStack 8 8.0+git.1593618123.678c32b-3.26.1
ardana-nova OpenStack Cloud 8, HPE Helion OpenStack 8 8.0+git.1601298847.dd01585-3.42.1
crowbar-core OpenStack Cloud Crowbar 8 5.0+git.1600432272.b3ad722f0-3.44.1
python-kombu OpenStack Cloud Crowbar 8, OpenStack Cloud 8, HPE Helion OpenStack 8 4.1.0-3.7.1
ardana-cinder OpenStack Cloud 8, HPE Helion OpenStack 8 8.0+git.1596129856.263f430-3.43.1

suse advisories SUSE-SU-2020:3309-1 SUSE-SU-2017:3029-1

ansible-14 openSUSE Tumbleweed 14.6.0-1.1
ansible-13 openSUSE Tumbleweed 13.7.0-1.1
ansible-12 openSUSE Tumbleweed 12.2.0-1.1
ansible-11 openSUSE Tumbleweed 11.11.0-1.1
ansible-10 openSUSE Tumbleweed 10.6.0-1.1
ansible-9 openSUSE Tumbleweed 9.8.0-1.1
ansible Package Hub 15 2.7.6-bp150.3.3.1

opensuse advisories openSUSE-SU-2026:12447-1 openSUSE-SU-2026:10944-1 openSUSE-SU-2025:15753-1 openSUSE-SU-2025:15605-1 openSUSE-SU-2024:14536-1 openSUSE-SU-2024:14244-1

github.com/ansible/ansible@0d41878 commit
github.com/ansible/ansible@7ff9fa5 commit

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2017-7466 updated 2026-06-30 cvss 8.0

ansible: Arbitrary code execution on control node (incomplete fix for CVE-2016-9587)

Red Hat Gluster Storage Server 3.2 on RHEL-7 ansible 2.2.3.0-1.el7
fixed: vendor fix RHSA-2017:1334
Red Hat OpenShift Container Platform 3.2 ansible 2.2.3.0-1.el7, openshift-ansible 3.2.56-1.git.0.b844ab7.el7, atomic-openshift-utils 3.2.56-1.git.0.b844ab7.el7, openshift-ansible-roles 3.2.56-1.git.0.b844ab7.el7, openshift-ansible-playbooks 3.2.56-1.git.0.b844ab7.el7, openshift-ansible-filter-plugins 3.2.56-1.git.0.b844ab7.el7, +1 more Red Hat OpenShift Container Platform 3.3 ansible 2.2.3.0-1.el7, openshift-ansible 3.3.82-1.git.0.af0c922.el7, atomic-openshift-utils 3.3.82-1.git.0.af0c922.el7, openshift-ansible-roles 3.3.82-1.git.0.af0c922.el7, openshift-ansible-playbooks 3.3.82-1.git.0.af0c922.el7, openshift-ansible-filter-plugins 3.3.82-1.git.0.af0c922.el7, +2 more Red Hat OpenShift Container Platform 3.4 ansible 2.2.3.0-1.el7, openshift-ansible 3.4.89-1.git.0.ac29ce8.el7, atomic-openshift-utils 3.4.89-1.git.0.ac29ce8.el7, openshift-ansible-roles 3.4.89-1.git.0.ac29ce8.el7, openshift-ansible-playbooks 3.4.89-1.git.0.ac29ce8.el7, openshift-ansible-filter-plugins 3.4.89-1.git.0.ac29ce8.el7, +2 more Red Hat OpenShift Container Platform 3.5 ansible 2.2.3.0-1.el7, openshift-ansible 3.5.71-1.git.0.128c2db.el7, atomic-openshift-utils 3.5.71-1.git.0.128c2db.el7, openshift-ansible-roles 3.5.71-1.git.0.128c2db.el7, openshift-ansible-playbooks 3.5.71-1.git.0.128c2db.el7, openshift-ansible-filter-plugins 3.5.71-1.git.0.128c2db.el7, +2 more
fixed: vendor fix RHSA-2017:1244
Red Hat OpenStack Platform 10.0 ansible 2.2.3.0-1.el7
fixed: vendor fix RHSA-2017:1599
Red Hat OpenStack Platform 11.0 ansible 2.2.3.0-1.el7
fixed: vendor fix RHSA-2017:1476
Red Hat Storage Console Installer 2 ansible 2.2.3.0-1.el7
fixed: vendor fix RHSA-2017:1499
Red Hat Virtualization Manager 4.1 ansible 2.3.0.0-4.el7
fixed: vendor fix RHSA-2017:1685
Red Hat OpenStack Platform 12 (Pike) ansible Red Hat Quickstart Cloud Installer 1 ansible
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

3.00% chance of exploitation in the next 30 days, higher than 87% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by	version	score	vector
CNA	3.0	8.0	CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
NVD	3.0	8.0	CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
NVD	2.0	8.5	AV:N/AC:M/Au:S/C:C/I:C/A:C
GitHub	3.0	8.0	CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Affected packages

ecosystem	package	affected	fixed in
pypi	ansible	<2.2.3.0 <2.3.0.0	2.2.3.0 2.3.0.0

Affected products

[UNKNOWN] ansible

Classification

Weakness

CWE-20 Improper Input Validation

References

github.com /ansible/ansible/commit/0d418789a298561fded9bce977d34babc9097079
web
github.com /ansible/ansible/commit/7ff9fa52cfcef2065f0db80d85dd94b9b754839c
web
access.redhat.com /errata/RHSA-2017:1599
vendor-advisory, web, third-party-advisory, advisory
access.redhat.com /errata/RHSA-2017:1334
vendor-advisory, web, third-party-advisory, advisory
access.redhat.com /errata/RHSA-2017:1685
vendor-advisory, web, third-party-advisory, advisory
access.redhat.com /errata/RHSA-2017:1244
vendor-advisory, web, third-party-advisory, advisory
access.redhat.com /errata/RHSA-2017:1499
vendor-advisory, web, third-party-advisory, advisory
access.redhat.com /errata/RHSA-2017:1476
vendor-advisory, web, third-party-advisory, advisory
securityfocus.com /bid/97595
vdb-entry, third-party-advisory, web
bugzilla.redhat.com /show_bug.cgi?id=CVE-2017-7466
web, issue-tracking, third-party-advisory, report
nvd.nist.gov /vuln/detail/CVE-2017-7466
advisory
github.com /ansible/ansible/issues/24186
web
github.com /ansible/ansible
package
github.com /pypa/advisory-database/tree/main/vulns/ansible/PYSEC-2018-40.yaml
web
web.archive.org /web/20170701161323/http://www.securityfocus.com/bid/97595
web
github.com /advisories/GHSA-3m8p-xpm6-8ww3
advisory

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary