CVE-2020-1738: Ansible Engine Module Package or Service Parameter Use Flaw
Summary
CVE-2020-1738: A flaw was found in Ansible Engine when the module package or service is used and the parameter 'use' is not specified. Affects ansible across 3 version ranges.
< 2.7.17
>= 2.8.0, < 2.8.9
>= 2.9.0, < 2.9.6
Fixed in 2.7.17, 2.8.9 or 2.9.6, depending on the release line you run. How to fix ↓
Also tracked for
- ansible · Debian:11
The same CVE-2020-1738 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ansible Engine is an open-source automation platform that allows users to automate IT tasks such as configuration management, application deployment, and orchestration. It is widely used in the industry for its simplicity and flexibility. The module package or service parameter in Ansible Engine allows users to specify the package or service to be managed. However, a flaw has been discovered in this functionality that can be exploited by a malicious user.
Vulnerability Detail
The vulnerability arises when the 'use' parameter is not specified in the module package or service. If a previous task is executed by a malicious user, they can manipulate the ansible facts file to select the module sent by the attacker. This can lead to unauthorized access, privilege escalation, or other malicious activities. The vulnerability affects all versions in the 2.7.x, 2.8.x, and 2.9.x branches of Ansible Engine.
How To Fix
Latest published version: 14.5.0 as of 22 Oct 2026
pip install --upgrade "ansible==14.5.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.7.172.7.17pip install --upgrade "ansible==2.7.17" -
>= 2.8.0, < 2.8.92.8.9pip install --upgrade "ansible==2.8.9" -
>= 2.9.0, < 2.9.62.9.6pip install --upgrade "ansible==2.9.6"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to the fixed versions is not immediately possible, a workaround can be implemented by ensuring that the 'use' parameter is always specified when using the module package or service. This can be done by explicitly setting the 'use' parameter in the Ansible playbook or command.
Conclusion
The vulnerability in Ansible Engine's module package or service parameter can be exploited by a malicious user to manipulate the module sent by the attacker. Upgrading to the fixed versions or implementing the provided workaround will mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ansible →
FAQ
Ansible Engine is an open-source automation platform used for configuration management, application deployment, and orchestration.
The vulnerability allows a malicious user to manipulate the module sent by the attacker, potentially leading to unauthorized access, privilege escalation, or other malicious activities.
All versions in the 2.7.x, 2.8.x, and 2.9.x branches of Ansible Engine are believed to be vulnerable.
To fix this vulnerability, it is recommended to upgrade to the fixed versions of Ansible Engine (2.7.17 or later, 2.8.9 or later, 2.9.6 or later).
Yes, a workaround is available by ensuring that the 'use' parameter is always specified when using the module package or service.
Related vulnerabilities
Recent vulnerabilities recorded for ansible.
