Ansible vulnerabilities

The user module in Ansible before version 1.6.6 allows remote authenticated users to execute arbitrary commands.

The chroot, jail, and zone connection plugins in Ansible before version 1.9.2 allow local users to escape a restricted environment via a symlink attack.

Ansible has a flaw where sensitive information stored in Ansible Vault files can be exposed in plaintext during playbook execution. This occurs when using tasks like include_vars without the no_log: true parameter, causing sensitive data to be printed in output or logs.