Every CVE Search/ Get API key

CVE-2021-3702

ansible-runner vulnerable to Race Condition

6.3 MediumFix available

CVE-2021-3702 is a medium vulnerability (CVSS 6.3) in Redhat Ansible Runner, published August 23, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.20%, the 10th percentile. Fixed in ansible-runner 2.1.0.

A race condition flaw was found in ansible-runner, where an attacker could watch for rapid creation and deletion of a temporary directory, substitute their directory at that name, and then have access to ansible-runner's private_data_dir the next time ansible-runner made use of the private_data_dir. The highest Threat out of this flaw is to integrity and confidentiality.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
High
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
None

Exploit likelihood

0.20%Down 0.7 points since Aug 24, 2022
90%50%10%1%

What each source reports

NVD Score used 6.3

A race condition flaw was found in ansible-runner, where an attacker could watch for rapid creation and deletion of a temporary directory, substitute their directory at that name, and then have access to ansible-runner's private_data_dir the next time ansible-runner made use of the private_data_dir. The highest Threat out of this flaw is to integrity and confidentiality.

Record
CVE-2021-3702
CVSS 3.1
6.3 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-362
Updated
2026-11-02
CVE List No score

A race condition flaw was found in ansible-runner, where an attacker could watch for rapid creation and deletion of a temporary directory, substitute their directory at that name, and then have access to ansible-runner's private_data_dir the next time ansible-runner made use of the private_data_dir. The highest Threat out of this flaw is to integrity and confidentiality.

Record
CVE-2021-3702
Weakness
CWE-362
Updated
2026-11-02
EUVDEUVD-2022-0005 No score

A race condition flaw was found in ansible-runner, where an attacker could watch for rapid creation and deletion of a temporary directory, substitute their directory at that name, and then have access to ansible-runner's private_data_dir the next time ansible-runner made use of the private_data_dir. The highest Threat out of this flaw is to integrity and confidentiality.

Record
EUVD-2022-0005
Updated
2026-11-03
GitHub AdvisoriesGHSA-772j-xvf9-qpf5 5.3

ansible-runner vulnerable to Race Condition

A race condition flaw was found in ansible-runner, where an attacker could watch for rapid creation and deletion of a temporary directory, substitute their directory at that name, and then have access to ansible-runner's private_data_dir the next time ansible-runner made use of the private_data_dir. The highest Threat out of this flaw is to integrity and confidentiality.

Record
GHSA-772j-xvf9-qpf5
CVSS 4.0
5.3 MediumCVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
6.3 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-362, CWE-377
Updated
2026-11-02
OSV 6.3

A race condition flaw was found in ansible-runner, where an attacker could watch for rapid creation and deletion of a temporary directory, substitute their directory at that name, and then have access to ansible-runner's private_data_dir the next time ansible-runner made use of the private_data_dir. The highest Threat out of this flaw is to integrity and confidentiality.

Record
CVE-2021-3702
CVSS 3.1
6.3 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVGHSA-772j-xvf9-qpf5 5.3

ansible-runner vulnerable to Race Condition

A race condition flaw was found in ansible-runner, where an attacker could watch for rapid creation and deletion of a temporary directory, substitute their directory at that name, and then have access to ansible-runner's private_data_dir the next time ansible-runner made use of the private_data_dir. The highest Threat out of this flaw is to integrity and confidentiality.

Record
GHSA-772j-xvf9-qpf5
CVSS 4.0
5.3 MediumCVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
6.3 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-362, CWE-377
Updated
2026-11-02
OSVPYSEC-2022-43068 6.3

A race condition flaw was found in ansible-runner, where an attacker could watch for rapid creation and deletion of a temporary directory, substitute their directory at that name, and then have access to ansible-runner's private_data_dir the next time ansible-runner made use of the private_data_dir. The highest Threat out of this flaw is to integrity and confidentiality.

Record
PYSEC-2022-43068
CVSS 3.1
6.3 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
ansible-runner
PyPI
2.0.0 up to 2.1.0
2.1.0
ansible-runner
PyPI
2.0.0 up to 2.1.0, plus listed versions
2.0.12.0.22.0.32.0.42.1.0.0a12.1.0.0a22.1.0.0b1
2.1.0

History

History
WhenChangedSources
2026-11-03aliasesEUVD
2026-11-02createdCVE List, GitHub Advisories, NVD, OSV

References

MoveEnter Open