CVE-2019-10156: Information Disclosure in Ansible

ansible Updated 02 Oct 2025

Summary

30/07/2019

Disclosed on

CVE-2019-10156

CVE

Yes i

Fix available

Moderate

Severity

5.4

CVSS Score

CVE-2019-10156: A flaw was discovered in the way Ansible templating was implemented in versions before 2.6.18, 2.7.12 and 2.8.2, causing the possibility of information disclosure through unexpected variable substitution. Affects ansible across 3 version ranges.

< 2.6.18 >= 2.7.0, < 2.7.12 >= 2.8.0, < 2.8.2

Fixed in 2.6.18, 2.7.12 or 2.8.2, depending on the release line you run. How to fix ↓

Also tracked for

ansible · Alpine:v3.10

The same CVE-2019-10156 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

Ansible is an open-source automation tool that allows users to automate IT tasks such as configuration management, application deployment, and orchestration. It uses a declarative language to describe system configurations and relies on templates for dynamic content generation. However, versions before 2.6.18, 2.7.12, and 2.8.2 of Ansible are vulnerable to an information disclosure issue through unexpected variable substitution. This vulnerability allows an attacker to disclose the content of any variable by exploiting unintended variable substitution.

Vulnerability Detail

The vulnerability in Ansible arises from a flaw in the implementation of templating. When variables are substituted in templates, an attacker can manipulate the substitution process to access sensitive information. By carefully crafting input, an attacker can force the template engine to reveal the content of any variable, potentially exposing confidential data. This vulnerability can have severe ramifications, especially in scenarios where sensitive information is stored in variables used within templates.

How To Fix

Latest published version: 14.5.0 as of 22 Oct 2026

pip install --upgrade "ansible==14.5.0"

Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.

If you can't move to the latest

The minimum fixed version depends on the release line you run.

< 2.6.18 2.6.18
```
pip install --upgrade "ansible==2.6.18"
```
>= 2.7.0, < 2.7.12 2.7.12
```
pip install --upgrade "ansible==2.7.12"
```
>= 2.8.0, < 2.8.2 2.8.2
```
pip install --upgrade "ansible==2.8.2"
```

Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →

Workaround

As a workaround, users can manually inspect and sanitize the variables used in templates to ensure that sensitive information is not inadvertently exposed. This can be done by carefully reviewing the templates and verifying that no confidential data is present in the variables being substituted. Additionally, it is advisable to restrict access to the affected templates to minimize the risk of exploitation.

Conclusion

In conclusion, the vulnerability in Ansible versions before 2.6.18, 2.7.12, and 2.8.2 allows for information disclosure through unintended variable substitution. Upgrading to a fixed version of Ansible or applying the suggested workaround mitigates the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for ansible →

FAQ

What is Ansible?

Ansible is an open-source automation tool used for IT task automation, configuration management, and application deployment.

What is the impact of this vulnerability?

This vulnerability allows an attacker to access the content of any variable, potentially exposing sensitive information stored within templates.

Which versions of Ansible are affected?

Versions before 2.6.18, 2.7.12, and 2.8.2 of Ansible are affected by this vulnerability.

How can I fix this vulnerability?

To fix this vulnerability, it is recommended to upgrade to version 2.6.18, 2.7.12, or 2.8.2 of Ansible, or any subsequent release that includes the fix.