CVE-2020-10684: Code Injection, Race Condition, and Execution with Unnecessary Privileges in Ansible
Summary
CVE-2020-10684: Code Injection, Race Condition, and Execution with Unnecessary Privileges in Ansible. Affects ansible across 3 version ranges.
>= 2.7.0a1, < 2.7.17
>= 2.8.0a1, < 2.8.11
>= 2.9.0a1, < 2.9.7
Fixed in 2.7.17, 2.8.11 or 2.9.7, depending on the release line you run. How to fix ↓
Also tracked for
- ansible · Debian:11
The same CVE-2020-10684 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ansible Engine is an open-source automation platform that allows users to automate tasks such as configuration management, application deployment, and orchestration. It is widely used in IT infrastructure management and provides a simple and powerful way to automate complex tasks. However, Ansible Engine versions 2.7.x, 2.8.x, and 2.9.x prior to 2.7.17, 2.8.9, and 2.9.6 respectively, are vulnerable to a code injection, race condition, and execution with unnecessary privileges.
Vulnerability Detail
The vulnerability arises when using ansible_facts as a subkey of itself and promoting it to a variable when inject is enabled. This allows an attacker to overwrite the ansible_facts after the clean, leading to privilege escalation or code injection. By altering the ansible_facts, an attacker can modify critical data such as ansible_hosts and users, potentially gaining unauthorized access or executing arbitrary code.
How To Fix
Latest published version: 14.5.0 as of 22 Oct 2026
pip install --upgrade "ansible==14.5.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 2.7.0a1, < 2.7.172.7.17pip install --upgrade "ansible==2.7.17" -
>= 2.8.0a1, < 2.8.112.8.11pip install --upgrade "ansible==2.8.11" -
>= 2.9.0a1, < 2.9.72.9.7pip install --upgrade "ansible==2.9.7"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to the fixed versions of Ansible Engine.
Conclusion
In conclusion, the vulnerability in Ansible Engine versions 2.7.x, 2.8.x, and 2.9.x prior to 2.7.17, 2.8.9, and 2.9.6 respectively, exposes systems to code injection, privilege escalation, and arbitrary code execution. It is highly recommended to upgrade to the fixed versions to ensure the security of your systems. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ansible →
FAQ
Ansible Engine is an open-source automation platform used for configuration management, application deployment, and orchestration.
Versions 2.7.x, 2.8.x, and 2.9.x of Ansible Engine prior to 2.7.17, 2.8.9, and 2.9.6 respectively are affected.
This vulnerability allows an attacker to perform code injection, escalate privileges, and potentially execute arbitrary code.
To fix this vulnerability, upgrade to the fixed versions of Ansible Engine: 2.7.17, 2.8.9, or 2.9.6.
No, there is no known workaround for this vulnerability. It is crucial to upgrade to the fixed versions.
References
Related vulnerabilities
Recent vulnerabilities recorded for ansible.
