CVE-2021-3533: Ansible - Race Condition Vulnerability
Summary
CVE-2021-3533: A flaw was found in Ansible if an ansible user sets ANSIBLE_ASYNC_DIR to a subdirectory of a world writable directory. Affects ansible versions < 3.0.0. Fixed in 3.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ansible is an open-source automation tool that allows users to automate IT tasks such as configuration management, application deployment, and orchestration. It is widely used in the industry due to its simplicity and flexibility. Ansible Tower is a web-based interface and REST API for Ansible that provides a user-friendly dashboard, role-based access control, job scheduling, and more. Ansible Automation Platform is a comprehensive solution that combines Ansible Tower with additional features for enterprise-scale automation. Both Ansible Tower 3.7 and Ansible Automation Platform 1.2 are affected by a race condition vulnerability.
Vulnerability Detail
The vulnerability (CVE-2021-3533) arises when an ansible user sets the ANSIBLE_ASYNC_DIR environment variable to a subdirectory of a world-writable directory. This creates a race condition on the managed machine, allowing a malicious non-privileged account on the remote machine to exploit the race condition and gain unauthorized access to the async result data. This vulnerability can lead to unauthorized disclosure of sensitive information and potential privilege escalation. It is important to note that this vulnerability only affects Ansible Tower 3.7 and Ansible Automation Platform 1.2.
How To Fix
Latest published version: 14.5.0 as of 22 Oct 2026
pip install --upgrade "ansible==14.5.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.0.0
This is the first release that contains the fix.
pip install --upgrade "ansible==3.0.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can avoid setting the ANSIBLE_ASYNC_DIR environment variable to a subdirectory of a world-writable directory. By ensuring that the ANSIBLE_ASYNC_DIR points to a directory with restricted permissions, the race condition can be mitigated. Here is an example of how to set the ANSIBLE_ASYNC_DIR variable to a safe directory:
export ANSIBLE_ASYNC_DIR=/path/to/safe/directory
Conclusion
The race condition vulnerability in Ansible (CVE-2021-3533) can be exploited by a malicious non-privileged account on the remote machine to gain unauthorized access to async result data. This can lead to unauthorized disclosure of sensitive information and potential privilege escalation. Users should upgrade to a fixed version of Ansible and follow the recommended steps to mitigate the vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ansible →
FAQ
This vulnerability affects Ansible Tower 3.7 and Ansible Automation Platform 1.2. Other versions of Ansible are not affected.
The vulnerability allows a malicious non-privileged account on the remote machine to access async result data, potentially leading to unauthorized disclosure of sensitive information and privilege escalation.
Yes, the vulnerability has been fixed in Ansible version 3.0.0 and later. Users should upgrade to a fixed version to mitigate the vulnerability.
Yes, users can avoid setting the ANSIBLE_ASYNC_DIR environment variable to a subdirectory of a world-writable directory as a temporary workaround. By setting the variable to a directory with restricted permissions, the race condition can be mitigated.
You can find more information about this vulnerability in the official Ansible documentation and the CVE-2021-3533 advisory.
References
Related vulnerabilities
Recent vulnerabilities recorded for ansible.
