CVE-2024-11079
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
A flaw in Ansible-Core allows attackers to bypass unsafe content protections using the hostvars object to reference and execute templated content, leading to arbitrary code execution.
Risk Assessment
The risk for the organization includes potential compromise of systems managed by Ansible if remote data or module outputs are improperly templated within playbooks.
Recommendation
Immediately update Ansible-Core to the latest patched version and review playbooks for secure handling of input data.
Other vulnerabilities in Ansible-Core
See all- CVE-2026-71465Low
RunAdHocCommand.build_args() appends limit as a bare positional (args.append(limit)) instead of using args.extend(['-l', limit]) like RunJob. A limit beginning with - is parsed as an ansible CLI option. Currently limited to short-circuit flags (--version, --help) since the injected element displaces the required pattern positional. Would escalate if ansible-core ever defaults pattern.
- CVE-2026-16493High
In ansible-core, the _extract_collection_from_git() function in concrete_artifact_manager.py constructs git clone commands without a '--' separator before user-supplied URLs. An attacker can provide a malicious collection source URI containing git argument injection, leading to arbitrary command execution during collection installation.
- CVE-2026-11332High
A flaw in ansible-core: the ansible-galaxy role install command processes dependency specifications from meta/requirements.yml. Due to improper neutralization of argument delimiters, a malicious role author can inject arbitrary git configuration flags via the src field, allowing arbitrary code execution on the machine of a user who installs the role.
Original NVD description (English source)
A flaw was found in Ansible-Core. This vulnerability allows attackers to bypass unsafe content protections using the hostvars object to reference and execute templated content. This issue can lead to arbitrary code execution if remote data or module outputs are improperly templated within playbooks.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS