Skip to content
Fencer Vulns
high 8.0

CVE-2016-7070 json

A privilege escalation flaw was found in the Ansible Tower.

published 2018-09-11 8 y ago modified 2026-06-17 4 mo ago also EUVD-2016-7950

cvss
8.0
version 3.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 50%
public exploits
0
none known

Summary

A privilege escalation flaw was found in the Ansible Tower. When Tower before 3.0.3 deploys a PostgreSQL database, it incorrectly configures the trust level of postgres user. An attacker could use this vulnerability to gain admin level access to the database.

Patch / fix

  • redhat ansible_tower 3.0.3

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2016-7070 updated cvss 8.0

Tower: PostgreSQL privilege escalation in Tower-deployed setups

  • Red Hat Ansible Tower 3 postgresql96-libs
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.64% chance of exploitation in the next 30 days, higher than 50% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.0 8.0 CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 3.0 8.0 CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 5.2 AV:A/AC:L/Au:S/C:P/I:P/A:P

Affected products

  • Red Hat Ansible Tower

Classification

Weakness
  • CWE-266 Incorrect Privilege Assignment
  • CWE-264 Permissions, Privileges, and Access Controls

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.