CVE-2024-11079
Ansible-core: unsafe tagging bypass via hostvars object in ansible-core
A flaw was found in Ansible-Core. This vulnerability allows attackers to bypass unsafe content protections using the hostvars object to reference and execute templated content. This issue can lead to arbitrary code execution if remote data or module outputs are improperly templated within playbooks.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Ansible-core: unsafe tagging bypass via hostvars object in ansible-core
A flaw was found in Ansible-Core. This vulnerability allows attackers to bypass unsafe content protections using the hostvars object to reference and execute templated content. This issue can lead to arbitrary code execution if remote data or module outputs are improperly templated within playbooks.
- Record
CVE-2024-11079- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L - Weakness
- CWE-20
- Updated
- 2026-11-05
EUVDEUVD-2024-3228
A flaw was found in Ansible-Core. This vulnerability allows attackers to bypass unsafe content protections using the hostvars object to reference and execute templated content. This issue can lead to arbitrary code execution if remote data or module outputs are improperly templated within playbooks.
- Record
EUVD-2024-3228- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L - Updated
- 2026-11-05
GitHub AdvisoriesGHSA-99w6-3xph-cx78
Ansible-Core vulnerable to content protections bypass
A flaw was found in Ansible-Core. This vulnerability allows attackers to bypass unsafe content protections using the hostvars object to reference and execute templated content. This issue can lead to arbitrary code execution if remote data or module outputs are improperly templated within playbooks.
- Record
GHSA-99w6-3xph-cx78- CVSS 4.0
- 1.2 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P - CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L - Weakness
- CWE-20
- Updated
- 2026-11-02
NVD
A flaw was found in Ansible-Core. This vulnerability allows attackers to bypass unsafe content protections using the hostvars object to reference and execute templated content. This issue can lead to arbitrary code execution if remote data or module outputs are improperly templated within playbooks.
- Record
CVE-2024-11079- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L - Weakness
- CWE-20
- Updated
- 2026-11-05
OSV
Ansible-core: unsafe tagging bypass via hostvars object in ansible-core
A flaw was found in Ansible-Core. This vulnerability allows attackers to bypass unsafe content protections using the hostvars object to reference and execute templated content. This issue can lead to arbitrary code execution if remote data or module outputs are improperly templated within playbooks.
- Record
CVE-2024-11079- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L - Weakness
- CWE-20
- Updated
- 2026-11-07
OSVDEBIAN-CVE-2024-11079
A flaw was found in Ansible-Core. This vulnerability allows attackers to bypass unsafe content protections using the hostvars object to reference and execute templated content. This issue can lead to arbitrary code execution if remote data or module outputs are improperly templated within playbooks.
- Record
DEBIAN-CVE-2024-11079- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L - Updated
- 2026-11-02
Show 11 moreShow less
OSVGHSA-99w6-3xph-cx78
Ansible-Core vulnerable to content protections bypass
A flaw was found in Ansible-Core. This vulnerability allows attackers to bypass unsafe content protections using the hostvars object to reference and execute templated content. This issue can lead to arbitrary code execution if remote data or module outputs are improperly templated within playbooks.
- Record
GHSA-99w6-3xph-cx78- CVSS 4.0
- 1.2 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P - CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVPYSEC-2026-1123
Ansible-Core vulnerable to content protections bypass
A flaw was found in Ansible-Core. This vulnerability allows attackers to bypass unsafe content protections using the hostvars object to reference and execute templated content. This issue can lead to arbitrary code execution if remote data or module outputs are improperly templated within playbooks.
- Record
PYSEC-2026-1123- CVSS 4.0
- 1.2 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P - CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L - Updated
- 2026-11-02
OSVRHSA-2024:11145
Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update
- Record
RHSA-2024:11145- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L - Updated
- 2026-11-02
OSVUBUNTU-CVE-2024-11079
A flaw was found in Ansible-Core. This vulnerability allows attackers to bypass unsafe content protections using the hostvars object to reference and execute templated content. This issue can lead to arbitrary code execution if remote data or module outputs are improperly templated within playbooks.
- Record
UBUNTU-CVE-2024-11079- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L - Updated
- 2026-11-02
OSVMGASA-2025-0052 No score
Updated python-ansible-core packages fix security vulnerabilities
Exposure of sensitive information in Ansible vault files due to improper logging. (CVE-2024-8775) Ansible-core user may read/write unauthorized content. (CVE-2024-9902) Unsafe tagging bypass via hostvars object in ansible-core. (CVE-2024-11079)
- Record
MGASA-2025-0052- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14545-1 No score
ansible-core-2.18.1-1.1 on GA media
These are all security issues fixed in the ansible-core-2.18.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14545-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14546-1 No score
ansible-core-2.16-2.16.14-1.1 on GA media
These are all security issues fixed in the ansible-core-2.16-2.16.14-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14546-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14547-1 No score
ansible-core-2.17-2.17.7-1.1 on GA media
These are all security issues fixed in the ansible-core-2.17-2.17.7-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14547-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:15638-1 No score
ansible-core-2.18-2.18.10-2.1 on GA media
These are all security issues fixed in the ansible-core-2.18-2.18.10-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:15638-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:15754-1 No score
ansible-core-2.19-2.19.4-1.1 on GA media
These are all security issues fixed in the ansible-core-2.19-2.19.4-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:15754-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:10945-1 No score
ansible-core-2.20-2.20.6-1.1 on GA media
These are all security issues fixed in the ansible-core-2.20-2.20.6-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:10945-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ansible-corePyPI |
2.18.0b1 up to 2.18.1rc1 | 2.18.1rc1 |
ansible-corePyPI |
2.17.0b1 up to 2.17.7rc1 | 2.17.7rc1 |
ansible-corePyPI |
before 2.16.14rc1 | 2.16.14rc1 |
ansibleDebian:12 |
before 5.4.0-1 | 5.4.0-1 |
ansibleDebian:13 |
before 5.4.0-1 | 5.4.0-1 |
ansibleDebian:14 |
before 5.4.0-1 | 5.4.0-1 |
ansible-coreDebian:12 |
before 2.14.18-0+deb12u1, plus listed versions 2.14.10-12.14.11-12.14.11-22.14.13-12.14.16-0+deb12u1 Show 6 moreShow less2.14.3-12.14.6-12.14.7-12.14.8-12.14.9-12.14.9-2 |
2.14.18-0+deb12u1 |
ansible-coreDebian:13 |
before 2.18.0-2 | 2.18.0-2 |
ansible-coreDebian:14 |
before 2.18.0-2 | 2.18.0-2 |
ansibleDebian:11 |
before 2.10.7+merged+base+2.10.17+dfsg-0+deb11u4, plus listed versions 2.10.7+merged+base+2.10.17+dfsg-0+deb11u12.10.7+merged+base+2.10.17+dfsg-0+deb11u22.10.7+merged+base+2.10.17+dfsg-0+deb11u32.10.7+merged+base+2.10.8+dfsg-1 |
2.10.7+merged+base+2.10.17+dfsg-0+deb11u4 |
Show 33 moreShow less
| Package | Affected | Fixed |
|---|---|---|
ansible-corePyPI |
2.18.0b1 up to 2.18.1rc1, plus listed versions 2.18.02.18.0rc12.18.0rc2 |
2.18.1rc1 |
ansible-corePyPI |
2.17.0b1 up to 2.17.7rc1, plus listed versions 2.17.02.17.0rc12.17.0rc22.17.12.17.1rc1 Show 11 moreShow less2.17.22.17.2rc12.17.2rc22.17.32.17.3rc12.17.42.17.4rc12.17.52.17.5rc12.17.62.17.6rc1 |
2.17.7rc1 |
ansible-corePyPI |
before 2.16.14rc1, plus listed versions 0.0.1a12.11.02.11.0b12.11.0b22.11.0b3 Show 45 moreShow less2.11.0b42.11.0rc12.11.0rc22.11.12.11.102.11.10rc12.11.112.11.11rc12.11.122.11.12rc12.11.1rc12.11.22.11.2rc12.11.32.11.3rc12.11.42.11.4rc12.11.52.11.5rc12.11.62.11.6rc12.11.72.11.7rc12.11.82.11.8rc12.11.92.11.9rc12.12.02.12.0b12.12.0b22.12.0rc12.12.12.12.102.12.10rc12.12.1rc12.12.22.12.2rc12.12.32.12.3rc12.12.42.12.4rc12.12.52.12.5rc12.12.62.12.6rc1 |
2.16.14rc1 |
python-ansible-coreMageia:9 From an advisory covering 3 CVEs |
before 2.14.18-1.mga9 | 2.14.18-1.mga9 |
ansible-corePyPI |
before 2.16.14rc1, 2.17.0b1 up to 2.17.7rc1, 2.18.0b1 up to 2.18.1rc1, plus listed versions 0.0.1a12.11.02.11.0b12.11.0b22.11.0b3 Show 45 moreShow less2.11.0b42.11.0rc12.11.0rc22.11.12.11.102.11.10rc12.11.112.11.11rc12.11.122.11.12rc12.11.1rc12.11.22.11.2rc12.11.32.11.3rc12.11.42.11.4rc12.11.52.11.5rc12.11.62.11.6rc12.11.72.11.7rc12.11.82.11.8rc12.11.92.11.9rc12.12.02.12.0b12.12.0b22.12.0rc12.12.12.12.102.12.10rc12.12.1rc12.12.22.12.2rc12.12.32.12.3rc12.12.42.12.4rc12.12.52.12.5rc12.12.62.12.6rc1 |
2.16.14rc12.17.7rc12.18.1rc1 |
ansible-coreRed Hat:ansible_automation_platform_developer:2.5::el8 From an advisory covering 2 CVEs |
before 1:2.16.14-1.el8ap | 1:2.16.14-1.el8ap |
ansible-coreRed Hat:ansible_automation_platform_inside:2.5::el8 From an advisory covering 2 CVEs |
before 1:2.16.14-1.el8ap | 1:2.16.14-1.el8ap |
ansible-coreRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 2 CVEs |
before 1:2.16.14-1.el8ap | 1:2.16.14-1.el8ap |
ansible-coreRed Hat:ansible_automation_platform_developer:2.5::el9 From an advisory covering 2 CVEs |
before 1:2.16.14-1.el9ap | 1:2.16.14-1.el9ap |
ansible-coreRed Hat:ansible_automation_platform_inside:2.5::el9 From an advisory covering 2 CVEs |
before 1:2.16.14-1.el9ap | 1:2.16.14-1.el9ap |
ansible-coreRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 2 CVEs |
before 1:2.16.14-1.el9ap | 1:2.16.14-1.el9ap |
automation-gateway-serverRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 2 CVEs |
before 0:2.5.20241218-1.el8ap | 0:2.5.20241218-1.el8ap |
automation-gateway-serverRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 2 CVEs |
before 0:2.5.20241218-1.el9ap | 0:2.5.20241218-1.el9ap |
ansibleUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 1.1+dfsg-11.3.4+dfsg-11.4.0+dfsg-11.4.1+dfsg-11.4.3+dfsg-1 Show 5 moreShow less1.4.4+dfsg-11.5.4+dfsg-11.5.4+dfsg-1ubuntu0.1~esm11.5.4+dfsg-1ubuntu0.1~esm21.5.4+dfsg-1ubuntu0.1~esm3 |
None known |
ansibleUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 1.9.2+dfsg-21.9.4-12.0.0.2-22.0.0.2-2ubuntu12.0.0.2-2ubuntu1.1 Show 8 moreShow less2.0.0.2-2ubuntu1.22.0.0.2-2ubuntu1.32.0.0.2-2ubuntu1.3+esm12.0.0.2-2ubuntu1.3+esm22.0.0.2-2ubuntu1.3+esm32.0.0.2-2ubuntu1.3+esm42.0.0.2-2ubuntu1.3+esm52.0.0.2-2ubuntu1.3+esm6 |
None known |
ansibleUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 2.3.1.0+dfsg-22.5.0+dfsg-12.5.1+dfsg-12.5.1+dfsg-1ubuntu0.12.5.1+dfsg-1ubuntu0.1+esm1 Show 4 moreShow less2.5.1+dfsg-1ubuntu0.1+esm22.5.1+dfsg-1ubuntu0.1+esm32.5.1+dfsg-1ubuntu0.1+esm42.5.1+dfsg-1ubuntu0.1+esm5 |
None known |
ansibleUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 2.8.3+dfsg-12.8.6+dfsg-12.9.2+dfsg-12.9.4+dfsg-12.9.6+dfsg-12.9.6+dfsg-1ubuntu0.1~esm12.9.6+dfsg-1ubuntu0.1~esm22.9.6+dfsg-1ubuntu0.1~esm3 |
None known |
ansible-coreUbuntu:22.04:LTS |
All versions, plus listed versions 2.12.0-12.12.0-1ubuntu0.1 |
None known |
ansibleUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 2.10.7+merged+base+2.10.8+dfsg-12.10.7+merged+base+2.10.8+dfsg-1ubuntu0.1~esm12.10.7+merged+base+2.10.8+dfsg-1ubuntu0.1~esm4 |
None known |
ansibleUbuntu:24.04:LTS |
All versions, plus listed versions 7.7.0+dfsg-17.7.0+dfsg-39.2.0+dfsg-0ubuntu49.2.0+dfsg-0ubuntu5 |
None known |
ansible-coreUbuntu:24.04:LTS |
All versions, plus listed versions 2.14.9-22.14.11-12.14.11-22.14.13-12.16.3-0ubuntu12.16.3-0ubuntu2 |
None known |
ansibleUbuntu:25.10 |
All versions, plus listed versions 11.2.0+dfsg-112.0.0~a2+dfsg-112.0.0~a4+dfsg-112.0.0~a6+dfsg-112.0.0~b1+dfsg-1 |
None known |
ansible-coreUbuntu:25.10 |
All versions, plus listed versions 2.18.1-4ubuntu12.19.0~beta4-1ubuntu12.19.0-1ubuntu1 |
None known |
ansibleUbuntu:26.10 |
All versions, plus listed versions 13.1.0+dfsg-1ubuntu113.4.0+dfsg-1 |
None known |
ansible-coreUbuntu:26.10 |
All versions, plus listed versions 2.20.1-12.21.1~rc1-12.21.1~rc1-22.21.1~rc1-2ubuntu12.22.0~beta2-1 |
None known |
ansibleUbuntu:26.04:LTS |
All versions, plus listed versions 12.0.0~b1+dfsg-112.0.0+dfsg-112.2.0+dfsg-113.1.0+dfsg-113.1.0+dfsg-1ubuntu1 |
None known |
ansible-coreUbuntu:26.04:LTS |
All versions, plus listed versions 2.19.0-1ubuntu12.19.4-12.20.1-1 |
None known |
ansible-coreopenSUSE:Tumbleweed |
before 2.18.1-1.1 | 2.18.1-1.1 |
ansible-core-2.16openSUSE:Tumbleweed |
before 2.16.14-1.1 | 2.16.14-1.1 |
ansible-core-2.17openSUSE:Tumbleweed |
before 2.17.7-1.1 | 2.17.7-1.1 |
ansible-core-2.18openSUSE:Tumbleweed From an advisory covering 6 CVEs |
before 2.18.10-2.1 | 2.18.10-2.1 |
ansible-core-2.19openSUSE:Tumbleweed From an advisory covering 6 CVEs |
before 2.19.4-1.1 | 2.19.4-1.1 |
ansible-core-2.20openSUSE:Tumbleweed From an advisory covering 6 CVEs |
before 2.20.6-1.1 | 2.20.6-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | CVE List, NVD, OSV | |
| facts | EUVD | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-11079 is a medium vulnerability (CVSS 5.5) in Red Hat Ansible Automation Platform Execution Environments, published November 11, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.53%, the 44th percentile. Fixed in ansible-core 2.18.1rc1.
References
access.redhat.com/errata/RHSA-2024:10770
bugzilla.redhat.com/show_bug.cgi?id=2325171
lists.debian.org/debian-lts-announce/2026/03/msg00006.html
nvd.nist.gov/vuln/detail/CVE-2024-11079
Show 32 moreShow less
github.com/ansible/ansible/pull/84299
catalog.redhat.com/software/containers
security-tracker.debian.org/tracker/CVE-2024-11079
advisories.mageia.org/MGASA-2025-0052.html
bugs.mageia.org/show_bug.cgi?id=33828
lists.opensuse.org/archives/list/[email protected]/message/2Y6RFLPB54N7XR7AP7A2DEXGLBEDEQJU
pypi.org/project/ansible-core
security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_11145.json
cve.org/CVERecord?id=CVE-2024-11079
ubuntu.com/security/CVE-2024-11079
suse.com/security/cve/CVE-2024-11079
Left out here: 293 versions. The JSON record has them.