CVE-2014-3498
Ansible Arbitrary Code Execution
The user module in ansible before 1.6.6 allows remote authenticated users to execute arbitrary commands.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The user module in ansible before 1.6.6 allows remote authenticated users to execute arbitrary commands.
- Record
CVE-2014-3498- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.5 Medium
AV:N/AC:L/Au:S/C:P/I:P/A:P - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
The user module in ansible before 1.6.6 allows remote authenticated users to execute arbitrary commands.
- Record
CVE-2014-3498- Updated
- 2026-11-02
EUVDEUVD-2017-0002 No score
The user module in ansible before 1.6.6 allows remote authenticated users to execute arbitrary commands.
- Record
EUVD-2017-0002- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4cvm-5776-jx9f
Ansible Arbitrary Code Execution
User module in ansible before 1.6.6 is vulnerable to command execution. Ansible can get the result of remote command in variable, which may come from untrusted source of input. If the content of variable isn't properly filtered and when attempting to use the variable, it will trigger a function that passes it through jinja 2 template engine that can result into arbitrary command execution. Under certain circumstances, unprivileged user on system that is being managed via ansible can execute code on the managing host under UID of running ansible process.
- Record
GHSA-4cvm-5776-jx9f- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
OSV
The user module in ansible before 1.6.6 allows remote authenticated users to execute arbitrary commands.
- Record
CVE-2014-3498- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2014-3498
The user module in ansible before 1.6.6 allows remote authenticated users to execute arbitrary commands.
- Record
DEBIAN-CVE-2014-3498- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-4cvm-5776-jx9f
Ansible Arbitrary Code Execution
User module in ansible before 1.6.6 is vulnerable to command execution. Ansible can get the result of remote command in variable, which may come from untrusted source of input. If the content of variable isn't properly filtered and when attempting to use the variable, it will trigger a function that passes it through jinja 2 template engine that can result into arbitrary command execution. Under certain circumstances, unprivileged user on system that is being managed via ansible can execute code on the managing host under UID of running ansible process.
- Record
GHSA-4cvm-5776-jx9f- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2014-3498
The user module in ansible before 1.6.6 allows remote authenticated users to execute arbitrary commands.
- Record
UBUNTU-CVE-2014-3498- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVPYSEC-2017-2 No score
The user module in ansible before 1.6.6 allows remote authenticated users to execute arbitrary commands.
- Record
PYSEC-2017-2- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ansiblePyPI |
before 1.6.6 | 1.6.6 |
ansibleDebian:12 |
before 1.7.0+dfsg-1 | 1.7.0+dfsg-1 |
ansibleDebian:13 |
before 1.7.0+dfsg-1 | 1.7.0+dfsg-1 |
ansibleDebian:14 |
before 1.7.0+dfsg-1 | 1.7.0+dfsg-1 |
ansiblePyPI |
before 1.6.6, plus listed versions 1.01.11.21.2.11.2.2 Show 24 moreShow less1.2.31.3.01.3.11.3.21.3.31.3.41.41.4.11.4.21.4.31.4.41.4.51.51.5.11.5.21.5.31.5.41.5.51.61.6.11.6.21.6.31.6.41.6.5 |
1.6.6 |
ansiblePyPI |
before 1.6.6, plus listed versions 1.01.11.21.2.11.2.2 Show 33 moreShow less1.2.31.3.01.3.11.3.21.3.31.3.41.41.4.11.4.21.4.31.4.41.4.51.51.5.11.5.21.5.31.5.41.5.51.61.6.11.6.21.6.31.6.41.6.5v1.6.0v1.4.0v1.2v1.1v1.00.70.30.0.10.01 |
1.6.6 |
ansibleUbuntu:Pro:14.04:LTS |
before 1.5.4+dfsg-1ubuntu0.1~esm1, plus listed versions 1.1+dfsg-11.3.4+dfsg-11.4.0+dfsg-11.4.1+dfsg-11.4.3+dfsg-11.4.4+dfsg-11.5.4+dfsg-1 |
1.5.4+dfsg-1ubuntu0.1~esm1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-3498 is a high vulnerability (CVSS 8.8) in Redhat Ansible, published June 8, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.59%, the 85th percentile. Fixed in ansible 1.6.6.
References
github.com/ansible/ansible/commit/8ed6350e65c82292a631f08845dfaacffe7f07f5
bugzilla.redhat.com/show_bug.cgi?id=1335551
nvd.nist.gov/vuln/detail/CVE-2014-3498
security-tracker.debian.org/tracker/CVE-2014-3498
ubuntu.com/security/CVE-2014-3498
cve.org/CVERecord?id=CVE-2014-3498