ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution
Published Jul 2, 2018
8.5
HIGHCVSS 4.0
EPSS 0.49%
Description
In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attacker's control, allowing to run arbitrary code as a result.
Affected products
- Vendor n/a Product Ansible Defaultn/a
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||
|---|---|---|---|---|---|---|
| n/a | Ansible | n/a |
|
- 2.0
- 2.4
- 2.5
- 2.6
- 10
- 12
- 13
- 4.0
- 4.0
No data.
Red Hat Ansible Engine 2 for RHEL 7
ansible-0:2.6.1-1.el7ae
Fixed · RHSA-2018:2151
Red Hat Ansible Engine 2.4 for RHEL 7
ansible-0:2.4.6.0-1.el7ae
Fixed · RHSA-2018:2152
Red Hat Ansible Engine 2.5 for RHEL 7
ansible-0:2.5.6-1.el7ae
Fixed · RHSA-2018:2150
Red Hat Ansible Engine 2.6 for RHEL 7
ansible-0:2.6.1-1.el7ae
Fixed · RHSA-2018:2166
Red Hat OpenStack Platform 10.0 (Newton)
ansible-0:2.4.6.0-1.el7ae
Fixed · RHSA-2019:0054
Red Hat OpenStack Platform 12.0 (Pike)
ansible-0:2.4.6.0-1.el7ae
Fixed · RHBA-2018:3788
Red Hat OpenStack Platform 12.0 (Pike)
ansible-role-redhat-subscription-0:1.0.1-4.el7ost
Fixed · RHBA-2018:3788
Red Hat OpenStack Platform 13.0 (Queens)
ansible-0:2.4.6.0-1.el7ae
Fixed · RHSA-2018:2585
Red Hat Virtualization 4 for Red Hat Enterprise Linux 7
imgbased-0:1.0.22-1.el7ev
Fixed · RHSA-2018:2321
Red Hat Virtualization 4 for Red Hat Enterprise Linux 7
redhat-release-virtualization-host-0:4.2-5.0.el7
Fixed · RHSA-2018:2321
Red Hat Virtualization 4 for Red Hat Enterprise Linux 7
redhat-virtualization-host-0:4.2-20180724.0
Fixed · RHSA-2018:2321
CloudForms Management Engine 5
ansible
Not affected
Red Hat Ceph Storage 2
ansible
Will not fix
Red Hat Ceph Storage 3
ansible
Will not fix
Red Hat OpenShift Enterprise 3
ansible
Will not fix
Red Hat OpenStack Platform 14 (Rocky)
ansible
Not affected
Red Hat Satellite 6
ansible
Not affected
Red Hat Storage 3
ansible
Will not fix
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Ansible Engine 2 for RHEL 7 | ansible-0:2.6.1-1.el7ae | Fixed | RHSA-2018:2151 |
| Red Hat Ansible Engine 2.4 for RHEL 7 | ansible-0:2.4.6.0-1.el7ae | Fixed | RHSA-2018:2152 |
| Red Hat Ansible Engine 2.5 for RHEL 7 | ansible-0:2.5.6-1.el7ae | Fixed | RHSA-2018:2150 |
| Red Hat Ansible Engine 2.6 for RHEL 7 | ansible-0:2.6.1-1.el7ae | Fixed | RHSA-2018:2166 |
| Red Hat OpenStack Platform 10.0 (Newton) | ansible-0:2.4.6.0-1.el7ae | Fixed | RHSA-2019:0054 |
| Red Hat OpenStack Platform 12.0 (Pike) | ansible-0:2.4.6.0-1.el7ae | Fixed | RHBA-2018:3788 |
| Red Hat OpenStack Platform 12.0 (Pike) | ansible-role-redhat-subscription-0:1.0.1-4.el7ost | Fixed | RHBA-2018:3788 |
| Red Hat OpenStack Platform 13.0 (Queens) | ansible-0:2.4.6.0-1.el7ae | Fixed | RHSA-2018:2585 |
| Red Hat Virtualization 4 for Red Hat Enterprise Linux 7 | imgbased-0:1.0.22-1.el7ev | Fixed | RHSA-2018:2321 |
| Red Hat Virtualization 4 for Red Hat Enterprise Linux 7 | redhat-release-virtualization-host-0:4.2-5.0.el7 | Fixed | RHSA-2018:2321 |
| Red Hat Virtualization 4 for Red Hat Enterprise Linux 7 | redhat-virtualization-host-0:4.2-20180724.0 | Fixed | RHSA-2018:2321 |
| CloudForms Management Engine 5 | ansible | Not affected | n/a |
| Red Hat Ceph Storage 2 | ansible | Will not fix | n/a |
| Red Hat Ceph Storage 3 | ansible | Will not fix | n/a |
| Red Hat OpenShift Enterprise 3 | ansible | Will not fix | n/a |
| Red Hat OpenStack Platform 14 (Rocky) | ansible | Not affected | n/a |
| Red Hat Satellite 6 | ansible | Not affected | n/a |
| Red Hat Storage 3 | ansible | Will not fix | n/a |
No package ranges for this CVE.
Remediation
Red Hat statement
Red Hat Gluster Storage 3 and Red Hat Ceph Storage 3 ships the affected version of ansible, but they no longer maintain their own version of ansible. Both the products will consume fixes directly from ansible repository.
Metrics
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
No CVSS v3.1 score for this CVE.
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
AV:L/AC:L/Au:N/C:P/I:P/A:P
This CVE is not in the KEV list.
No CISA SSVC assessment for this CVE yet.
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.
Score over time
2021–2026- EPSS v1
- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Percentile over time
- EPSS v1
- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Table of values (14 key points)
Flat stretches are collapsed; showing up to 120 newest points.
| Date | Score | Percentile | Model |
|---|---|---|---|
| Oct 1, 2026 | 0.49% (0.00489) | 39.84th | v5 (v2026.06.15) |
| Jun 15, 2026 | 0.48% (0.00485) | 37.77th | v5 (v2026.06.15) |
| Mar 17, 2025 | 0.05% (0.00052) | 13.40th | v4 (v2025.03.14) |
| Dec 12, 2024 | 0.07% (0.00075) | 34.46th | v3 (v2023.03.01) |
| Jun 26, 2023 | 0.07% (0.00075) | 30.84th | v3 (v2023.03.01) |
| Mar 7, 2023 | 0.05% (0.00054) | 19.79th | v3 (v2023.03.01) |
| Mar 6, 2023 | 1.86% (0.01864) | 77.24th | v2 (v2022.01.01) |
| Feb 3, 2023 | 1.86% (0.01864) | 76.66th | v2 (v2022.01.01) |
| Apr 1, 2022 | 1.28% (0.01282) | 65.91th | v2 (v2022.01.01) |
| Feb 4, 2022 | 1.28% (0.01282) | 41.72th | v2 (v2022.01.01) |
| Feb 3, 2022 | 2.48% (0.02476) | 54.92th | v1 |
| Jan 6, 2022 | 2.48% (0.02476) | 54.49th | v1 |
| Sep 1, 2021 | 2.48% (0.02476) | 78.74th | v1 |
| Apr 14, 2021 | 2.48% (0.02476) | 0.00th | v1 |
References (22)
- http://www.securitytracker.com/id/1041396 vdb-entryx_refsource_SECTRACKThird Party AdvisoryVDB Entry
- https://access.redhat.com/errata/RHBA-2018:3788 vendor-advisoryx_refsource_REDHATVendor Advisory
- https://access.redhat.com/errata/RHSA-2018:2150 vendor-advisoryx_refsource_REDHATVendor Advisory
- https://access.redhat.com/errata/RHSA-2018:2151 vendor-advisoryx_refsource_REDHATVendor Advisory
- https://access.redhat.com/errata/RHSA-2018:2152 vendor-advisoryx_refsource_REDHATVendor Advisory
- https://access.redhat.com/errata/RHSA-2018:2166 vendor-advisoryx_refsource_REDHATVendor Advisory
- https://access.redhat.com/errata/RHSA-2018:2321 vendor-advisoryx_refsource_REDHATVendor Advisory
- https://access.redhat.com/errata/RHSA-2018:2585 vendor-advisoryx_refsource_REDHATVendor Advisory
- https://access.redhat.com/errata/RHSA-2019:0054 vendor-advisoryx_refsource_REDHATVendor Advisory
- https://access.redhat.com/security/cve/CVE-2018-10874 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1596528 Issue Tracking
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10874 x_refsource_CONFIRMIssue TrackingVendor Advisory
- https://github.com/advisories/GHSA-3xvg-x47j-x75w Advisory
- https://github.com/ansible/ansible/commit/10d6fe6c98cfee9a7be0fea6102ba5dec951aec7
- https://github.com/ansible/ansible/commit/1f80949f964a946773f9d3ac1899535bd2cc2b8e
- https://github.com/ansible/ansible/commit/44874addc7ea136f83c67d5869047ece02645fdb
- https://github.com/ansible/ansible/pull/42067
- https://github.com/pypa/advisory-database/tree/main/vulns/ansible/PYSEC-2018-81.yaml
- https://nvd.nist.gov/vuln/detail/CVE-2018-10874
- https://usn.ubuntu.com/4072-1 vendor-advisoryx_refsource_UBUNTU
- https://web.archive.org/web/20201130165946/http://www.securitytracker.com/id/1041396
- https://www.cve.org/CVERecord?id=CVE-2018-10874
Change history (0)
No recorded changes yet.