Skip to content
Fencer Intel
high 7.5

CVE-2026-33154 json

dynaconf Affected by Remote Code Execution (RCE) via Insecure Template Evaluation in @jinja Resolver

published 7mo ago modified last mo. also GHSA-pxrr-hq57-q35p , PYSEC-2026-2147 , EUVD-2026-13790

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 46%
public exploits
0
none known

Summary

dynaconf is a configuration management tool for Python. Prior to version 3.2.13, Dynaconf is vulnerable to Server-Side Template Injection (SSTI) due to unsafe template evaluation in the @Jinja resolver. When the jinja2 package is installed, Dynaconf evaluates template expressions embedded in configuration values without a sandboxed environment. This issue has been patched in version 3.2.13.

Patch / fix

  • pypi dynaconf 3.2.13
  • dynaconf dynaconf 3.2.13
  • python-dynaconf Debian 13 3.1.7-2+deb13u1
  • python-dynaconf Debian 14 3.2.13-1

debian advisories DEBIAN-CVE-2026-33154

  • python-dynaconf Ubuntu 24.04 LTS 3.1.7-2ubuntu0.24.04.1
  • python-dynaconf Ubuntu 25.10 3.1.7-2ubuntu0.25.10.1
  • python-dynaconf Ubuntu Pro 22.04 LTS 3.1.7-1ubuntu0.1~esm1
  • python-dynaconf Ubuntu Pro 26.04 LTS 3.2.12-1ubuntu0.1~esm1

ubuntu advisories UBUNTU-CVE-2026-33154

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • foreman satellite utils 6.17, satellite capsule 6.17, satellite 6.17 3.14.0.22-1.el9sat
  • satellite satellite utils 6.17, satellite capsule 6.17, satellite 6.17 6.17.12-1.el9sat
  • foreman-cli satellite utils 6.17, satellite 6.17 3.14.0.22-1.el9sat
  • foreman-ec2 satellite 6.17 3.14.0.22-1.el9sat
  • foreman-pcp satellite capsule 6.17, satellite 6.17 3.14.0.22-1.el9sat
  • python-lxml satellite capsule 6.17, satellite 6.17 5.3.1-2.el9pc
  • foreman-ovirt satellite 6.17 3.14.0.22-1.el9sat
  • foreman-redis satellite 6.17 3.14.0.22-1.el9sat

red hat advisories RHSA-2026:74505RHSA-2026:74504RHSA-2026:74506RHSA-2026:74503RHSA-2026:34160

  • python-dynaconf openSUSE Leap 16.0 3.2.5-bp160.2.1
  • python-dynaconf openSUSE Tumbleweed 3.2.13-1.1

opensuse advisories openSUSE-SU-2026:20429-1openSUSE-SU-2026:10411-1

Is CVE-2026-33154 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-33154 updated cvss 7.5

dynaconf: jinja2: Dynaconf: Arbitrary code execution via Server-Side Template Injection

  • Red Hat Ansible Automation Platform 2 ansible-automation-platform-26/hub-rhel9, ansible-automation-platform-26/lightspeed-rhel9, ansible-automation-platform/automation-dashboard-rhel9, ansible-automation-platform-tech-preview/automation-dashboard-rhel9
    affected: workaround, no fix available, no fix planned “Will not fix”
  • Red Hat Update Infrastructure 5 rhui5/rhua-rhel9
    affected: workaround, no fix available
  • Red Hat Ansible Automation Platform 2 python-dynaconf, python3x-dynaconf, python3.11-dynaconf, python3.12-dynaconf, ansible-automation-platform-24/hub-rhel8, ansible-automation-platform-25/hub-rhel8, +11 more
    under investigation
  • Red Hat Ansible Automation Platform 2.5 ansible-automation-platform-25 1777403872
    fixed: vendor fix RHSA-2026:13553
  • Red Hat Ansible Automation Platform 2.6 ansible-automation-platform-26 1777296732, ansible-automation-platform-26 1777311120, ansible-automation-platform-26/controller-rhel9 1779762270, ansible-automation-platform-26/controller-rhel9 1782766803
    fixed: vendor fix RHSA-2026:34374
  • Red Hat Ansible Automation Platform 2.6 for RHEL 9 automation-controller 4.7.13-2.el9ap, automation-controller-ui 4.7.13-2.el9ap, automation-controller-cli 4.7.13-2.el9ap, automation-controller-server 4.7.13-2.el9ap, automation-controller-venv-tower 4.7.13-2.el9ap
    fixed: vendor fix RHSA-2026:34160
  • Red Hat Satellite 6.16 for RHEL 8 python-dynaconf 3.2.13-1.el8pc, python3.11-dynaconf 3.2.13-1.el8pc Red Hat Satellite 6.16 for RHEL 9 python-dynaconf 3.2.13-1.el9pc, python3.11-dynaconf 3.2.13-1.el9pc
    fixed: vendor fix RHSA-2026:74506
  • Red Hat Satellite 6.17 for RHEL 9 python-dynaconf 3.2.13-1.el9pc, python3.11-dynaconf 3.2.13-1.el9pc
    fixed: vendor fix RHSA-2026:74505
show 3 more
  • Red Hat Satellite 6.18 for RHEL 9 python3.12-dynaconf 3.2.13-2.el9pc
    fixed: vendor fix RHSA-2026:74504
  • Red Hat Satellite 6.19 for RHEL 9 python3.12-dynaconf 3.2.13-2.el9pc
    fixed: vendor fix RHSA-2026:74503
  • Red Hat Ansible Automation Platform 2.5 ansible-automation-platform 1777407814, ansible-automation-platform 1777407821, ansible-automation-platform-25 1777191649, ansible-automation-platform-25 1777191659, ansible-automation-platform-25 1777191672, ansible-automation-platform-25 1777191685, +20 more Red Hat Ansible Automation Platform 2.6 ansible-automation-platform 1777410604, ansible-automation-platform 1777410621, ansible-automation-platform-26 1777163004, ansible-automation-platform-26 1777163348, ansible-automation-platform-26 1777163557, ansible-automation-platform-26 1777163594, +81 more Red Hat Ansible Automation Platform 2.6 for RHEL 9 automation-hub 4.11.10-1.el9ap, python3.12-pyjwt 2.13.0-1.el9ap, python3.12-urllib3 2.7.0-1.el9ap, python3.12-pysequoia 0.1.34-1.el9ap, python3.12-galaxy-ng 4.11.10-1.el9ap, automation-platform-ui 2.6.10-1.el9ap, +22 more Red Hat Satellite 6.16 for RHEL 8 python-lxml 4.9.2-5.el8pc, foreman 3.12.0.23-1.el8sat, satellite 6.16.14-1.el8sat, python-sqlparse 0.6.0-1.el8pc, python3.11-lxml 4.9.2-5.el8pc, foreman-cli 3.12.0.23-1.el8sat, +26 more Red Hat Satellite 6.16 for RHEL 9 python-lxml 4.9.2-5.el9pc, foreman 3.12.0.23-1.el9sat, satellite 6.16.14-1.el9sat, python-sqlparse 0.6.0-1.el9pc, python3.11-lxml 4.9.2-5.el9pc, foreman-cli 3.12.0.23-1.el9sat, +26 more Red Hat Satellite 6.17 for RHEL 9 python-lxml 5.3.1-2.el9pc, foreman 3.14.0.22-1.el9sat, satellite 6.17.12-1.el9sat, python-sqlparse 0.6.0-1.el9pc, python3.11-lxml 5.3.1-2.el9pc, foreman-cli 3.14.0.22-1.el9sat, +25 more
    +4 more products
    Red Hat Satellite 6.18 for RHEL 9 foreman 3.16.0.25-1.el9sat, satellite 6.18.10-1.el9sat, foreman-cli 3.16.0.25-1.el9sat, foreman-ec2 3.16.0.25-1.el9sat, foreman-pcp 3.16.0.25-1.el9sat, satellite-cli 6.18.10-1.el9sat, +21 more Red Hat Satellite 6.19 for RHEL 9 satellite 6.19.5-1.el9sat, foreman 3.18.0.14-1.el9sat, satellite-cli 6.19.5-1.el9sat, foreman-cli 3.18.0.14-1.el9sat, foreman-ec2 3.18.0.14-1.el9sat, foreman-pcp 3.18.0.14-1.el9sat, +23 more Red Hat Update Infrastructure 4 for Cloud Providers python-dynaconf Red Hat Update Infrastructure 5 rhui5/rhua-tp-rhel9
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
total
Assessed
7mo ago

Exploit prediction

0.55% chance of exploitation in the next 30 days, higher than 46% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • github.com https://github.com/dynaconf/dynaconf/security/advisories/GHSA-pxrr-hq57-q35p referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
OSV 3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
pypi dynaconf
<3.2.13
3.2.13

Affected products

  • dynaconf dynaconf

Classification

Weakness
  • CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine
  • CWE-94 Improper Control of Generation of Code
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.