CVE-2021-4112
A flaw was found in ansible-tower where the default installation is vulnerable to job isolation...
A flaw was found in ansible-tower where the default installation is vulnerable to job isolation escape. This flaw allows an attacker to elevate the privilege from a low privileged user to an AWX user from outside the isolated environment.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
A flaw was found in ansible-tower where the default installation is vulnerable to job isolation escape. This flaw allows an attacker to elevate the privilege from a low privileged user to an AWX user from outside the isolated environment.
- Record
CVE-2021-4112- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-552
- Updated
- 2026-11-02
CVE List No score
A flaw was found in ansible-tower where the default installation is vulnerable to job isolation escape. This flaw allows an attacker to elevate the privilege from a low privileged user to an AWX user from outside the isolated environment.
- Record
CVE-2021-4112- Weakness
- CWE-552
- Updated
- 2026-11-02
EUVDEUVD-2021-33992 No score
A flaw was found in ansible-tower where the default installation is vulnerable to job isolation escape. This flaw allows an attacker to elevate the privilege from a low privileged user to an AWX user from outside the isolated environment.
- Record
EUVD-2021-33992- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-2q78-vv73-5vr2
A flaw was found in ansible-tower where the default installation is vulnerable to job isolation...
A flaw was found in ansible-tower where the default installation is vulnerable to job isolation escape. This flaw allows an attacker to elevate the privilege from a low privileged user to an AWX user from outside the isolated environment.
- Record
GHSA-2q78-vv73-5vr2- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-552
- Updated
- 2026-11-02
OSVRHSA-2022:0460
Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.1 ansible-runner security update
- Record
RHSA-2022:0460- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2022:0474
Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.0 ansible-runner security update
- Record
RHSA-2022:0474- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ansible-runnerRed Hat:ansible_automation_platform:2.1::el8 |
before 0:2.1.1-2.el8ap | 0:2.1.1-2.el8ap |
python38-ansible-runnerRed Hat:ansible_automation_platform:2.1::el8 |
before 0:2.1.1-2.el8ap | 0:2.1.1-2.el8ap |
ansible-runnerRed Hat:ansible_automation_platform:2.0::el8 |
before 0:2.0.3-3.el8ap | 0:2.0.3-3.el8ap |
python38-ansible-runnerRed Hat:ansible_automation_platform:2.0::el8 |
before 0:2.0.3-3.el8ap | 0:2.0.3-3.el8ap |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, products | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-4112 is a high vulnerability (CVSS 8.8) in Red Hat Ansible-tower, published August 25, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.25%, the 16th percentile. Fixed in ansible-runner 0:2.1.1-2.el8ap.