CVE-2019-10206: Vulnerability in Ansible
Summary
CVE-2019-10206: ansible-playbook -k and ansible cli tools, all versions 2.8.x before 2.8.4, all 2.7.x before 2.7.13 and all 2.6.x before 2.6.19, prompt passwords by expanding them from templates as they could contain special characters. Affects ansible across 3 version ranges.
>= 2.6.0, < 2.6.19
>= 2.7.0, < 2.7.13
>= 2.8.0, < 2.8.4
Fixed in 2.6.19, 2.7.13 or 2.8.4, depending on the release line you run. How to fix ↓
Also tracked for
- ansible · Alpine:v3.10
The same CVE-2019-10206 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ansible is an open-source automation tool that allows users to automate IT tasks such as configuration management, application deployment, and orchestration. It is widely used in the industry due to its simplicity and flexibility. However, Ansible versions 2.8.x before 2.8.4, 2.7.x before 2.7.13, and 2.6.x before 2.6.19 are susceptible to a vulnerability that prompts passwords by expanding them from templates, potentially exposing them if they contain special characters. To mitigate this issue, passwords should be wrapped to prevent template triggers.
Vulnerability Detail
The vulnerability in Ansible arises from the way passwords are handled when using the 'ansible-playbook -k' and 'ansible' CLI tools. These tools prompt users for passwords by expanding them from templates, which can lead to the exposure of sensitive information. If a password contains special characters, it can inadvertently trigger template expansion and result in the password being exposed. This vulnerability can have severe consequences as it may allow unauthorized access to systems or compromise sensitive data.
How To Fix
Latest published version: 14.5.0 as of 22 Oct 2026
pip install --upgrade "ansible==14.5.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 2.6.0, < 2.6.192.6.19pip install --upgrade "ansible==2.6.19" -
>= 2.7.0, < 2.7.132.7.13pip install --upgrade "ansible==2.7.13" -
>= 2.8.0, < 2.8.42.8.4pip install --upgrade "ansible==2.8.4"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a workaround, users can manually wrap passwords in quotes or use escape characters to prevent template expansion. For example, instead of providing the password 'my!pass', it can be wrapped as 'my'!pass' or 'my!pass'. This ensures that the password is not mistakenly interpreted as a template and avoids potential exposure.
Conclusion
The vulnerability in Ansible versions 2.8.x before 2.8.4, 2.7.x before 2.7.13, and 2.6.x before 2.6.19 can lead to the exposure of passwords containing special characters. It is crucial to upgrade to the fixed versions or apply the provided workaround to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ansible →
FAQ
Ansible is an open-source automation tool used for configuration management, application deployment, and orchestration.
The vulnerability affects Ansible versions 2.8.x before 2.8.4, 2.7.x before 2.7.13, and 2.6.x before 2.6.19.
This vulnerability can potentially expose passwords containing special characters, leading to unauthorized access or compromise of sensitive data.
To fix this vulnerability, upgrade to the fixed versions of Ansible: 2.6.19 or later for 2.6.x, 2.7.13 or later for 2.7.x, and 2.8.4 or later for 2.8.x.
Yes, users can manually wrap passwords in quotes or use escape characters to prevent template expansion.
Related vulnerabilities
Recent vulnerabilities recorded for ansible.
