Skip to content
Fencer Vulns
high 7.8

CVE-2018-10874 json

Ansible Improper Input Validation vulnerability

published 2018-07-02 8 y ago modified 2026-06-17 4 mo ago also GHSA-3xvg-x47j-x75w , PYSEC-2018-81 , EUVD-2018-0020

cvss
7.8
version 3.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 40%
public exploits
0
none known

Summary

In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attacker's control, allowing to run arbitrary code as a result.

Patch / fix

  • pypi ansible 2.4.6.0, 2.5.6, 2.6.1
  • ansible Debian 14, Debian 13, Debian 12 2.6.1+dfsg-1

debian advisories DEBIAN-CVE-2018-10874

  • ansible Ubuntu 18.04 LTS 2.5.1+dfsg-1ubuntu0.1

ubuntu advisories UBUNTU-CVE-2018-10874

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • ansible openstack 13, openstack 12, openstack 10 +1 more 2.4.6.0-1.el7ae
  • ansible ansible engine 2.5 2.5.6-1.el7ae
  • ansible ansible engine 2.6, ansible engine 2 2.6.1-1.el7ae
  • imgbased RHEL 7 1.0.22-1.el7ev
  • python-imgbased RHEL 7 1.0.22-1.el7ev
  • redhat-virtualization-host RHEL 7 4.2-20180724.0.el7_5
  • redhat-release-virtualization-host RHEL 7 4.2-5.0.el7
  • redhat-virtualization-host-image-update RHEL 7 4.2-20180724.0.el7_5

red hat advisories RHSA-2018:2585RHSA-2018:2150RHSA-2018:2151RHSA-2018:2166RHSA-2018:2152RHSA-2018:2321

  • ansible openSUSE Leap 15.5, Manager Proxy Module 4.3, Manager Client Tools 15 2.9.27-150000.1.17.2
  • grafana Manager Client Tools 15 9.5.18-150000.1.63.2
  • spacecmd openSUSE Leap 15.5, Manager Client Tools 15 4.3.27-150000.3.116.2
  • mgr-daemon Manager Client Tools 15 4.3.9-150000.1.47.2
  • spacewalk-koan Manager Client Tools 15 4.3.6-150000.3.33.2
  • dracut-saltboot openSUSE Leap 15.5, Manager Client Tools for SLE Micro 5, Manager Client Tools 15 0.1.1710765237.46af599-150000.1.53.2
  • POS_Image-JeOS7 openSUSE Leap 15.5, Manager Client Tools 15 0.1.1710765237.46af599-150000.1.21.2
  • uyuni-common-libs Manager Client Tools 15 4.3.10-150000.1.39.2

suse advisories SUSE-SU-2024:1509-1SUSE-SU-2024:1427-1SUSE-SU-2018:4130-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2018-10874 updated cvss 7.8

ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution

  • Red Hat Ceph Storage 2 ansible Red Hat Ceph Storage 3 ansible Red Hat OpenShift Enterprise 3 ansible Red Hat Storage 3 ansible
    affected: no fix planned “Will not fix”
  • Red Hat Ansible Engine 2 for RHEL 7 ansible 2.6.1-1.el7ae
    fixed: vendor fix RHSA-2018:2151
  • Red Hat Ansible Engine 2.4 for RHEL 7 Server ansible 2.4.6.0-1.el7ae
    fixed: vendor fix RHSA-2018:2152
  • Red Hat Ansible Engine 2.5 for RHEL 7 Server ansible 2.5.6-1.el7ae
    fixed: vendor fix RHSA-2018:2150
  • Red Hat Ansible Engine 2.6 for RHEL 7 Server ansible 2.6.1-1.el7ae
    fixed: vendor fix RHSA-2018:2166
  • Red Hat OpenStack Platform 10.0 ansible 2.4.6.0-1.el7ae
    fixed: vendor fix RHSA-2019:0054
  • Red Hat OpenStack Platform 12.0 ansible 2.4.6.0-1.el7ae, ansible-role-redhat-subscription 1.0.1-4.el7ost
    fixed: vendor fix RHBA-2018:3788
  • Red Hat OpenStack Platform 13.0 ansible 2.4.6.0-1.el7ae
    fixed: vendor fix RHSA-2018:2585
show 2 more
  • Red Hat Virtualization 4 Hypervisor for RHEL 7 redhat-virtualization-host 4.2-20180724.0.el7_5, redhat-virtualization-host-image-update 4.2-20180724.0.el7_5 Red Hat RHEL 7-based RHEV-H for RHEV 4 (build requirements) imgbased 1.0.22-1.el7ev, python-imgbased 1.0.22-1.el7ev, redhat-release-virtualization-host 4.2-5.0.el7, redhat-virtualization-host-image-update-placeholder 4.2-5.0.el7
    fixed: vendor fix RHSA-2018:2321
  • Red Hat CloudForms Management Engine 5 ansible Red Hat OpenStack Platform 14 (Rocky) ansible Red Hat Satellite 6 ansible
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.47% chance of exploitation in the next 30 days, higher than 40% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.0 7.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 3.0 7.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 4.6 AV:L/AC:L/Au:N/C:P/I:P/A:P
GitHub 3.0 7.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
pypi ansible
<2.4.6.0
>=2.5, <2.5.6
>=2.6, <2.6.1
2.4.6.0
2.5.6
2.6.1

Affected products

  • [UNKNOWN] ansible

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.