CVE-2024-11079

Ansible-core: unsafe tagging bypass via hostvars object in ansible-core

State: Published
Severity: 5.5 Medium
Published: Nov 11, 2024
Updated: Jun 29, 2026
Reserved: Nov 11, 2024

Description

A flaw was found in Ansible-Core. This vulnerability allows attackers to bypass unsafe content protections using the hostvars object to reference and execute templated content. This issue can lead to arbitrary code execution if remote data or module outputs are improperly templated within playbooks.

Scores

CVSS	Score	Vector	Source
3.1	5.5 Medium	CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L	redhat

Weaknesses

CWE-20 Improper Input Validation

Affected Products

Product	Versions
ansible-core	2.18.0 and earlierAffected
Ansible Automation Platform Execution EnvironmentsRed Hat	1.2.0-93 and laterNot affected
Ansible Automation Platform Execution EnvironmentsRed Hat	3.0.1-108 and laterNot affected
Ansible Automation Platform Execution EnvironmentsRed Hat	2.9.27-34 and laterNot affected
Ansible Automation Platform Execution EnvironmentsRed Hat	2.12.10-56 and laterNot affected
Ansible Automation Platform Execution EnvironmentsRed Hat	2.15.13-4 and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 8Red Hat	1:2.16.14-1.el8ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 9Red Hat	1:2.16.14-1.el9ap and laterNot affected
Red Hat Enterprise Linux 10Red Hat
Red Hat Enterprise Linux AI (RHEL AI)Red Hat
Red Hat Enterprise Linux AI (RHEL AI)Red Hat

References

RHSA-2024:10770vendor-advisory
RHSA-2024:11145vendor-advisory
https://access.redhat.com/security/cve/CVE-2024-11079vdb-entry
RHBZ#2325171issue-tracking
https://lists.debian.org/debian-lts-announce/2026/03/msg00006.html

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.