CVE-2020-10744: Insecure Temporary Directory in Ansible

ansible Updated 02 Oct 2025

Summary

15/05/2020

Disclosed on

CVE-2020-10744

CVE

Yes i

Fix available

Low

Severity

5.0

CVSS Score

CVE-2020-10744: An incomplete fix was found for the fix of the flaw CVE-2020-1733 ansible: insecure temporary directory when running become_user from become directive. Affects ansible across 3 version ranges.

>= 2.7.0, < 2.8.0a1 >= 2.8.0, < 2.8.13 >= 2.9.0, < 2.9.10

Fixed in 2.8.0a1, 2.8.13 or 2.9.10, depending on the release line you run. How to fix ↓

Also tracked for

ansible · Debian:11

The same CVE-2020-10744 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

Ansible is an open-source automation tool that allows users to automate tasks such as configuration management, application deployment, and orchestration. It is widely used in IT infrastructure automation and has a large community of contributors. However, a vulnerability has been discovered in Ansible that could potentially lead to unauthorized access and privilege escalation.

Vulnerability Detail

The vulnerability, identified as CVE-2020-10744, stems from an incomplete fix for a previously known flaw (CVE-2020-1733) in Ansible. The flaw involves the insecure use of temporary directories when running the 'become_user' command from the 'become' directive. The provided fix was found to be insufficient, particularly on systems using ACLs and FUSE filesystems. This race condition could be exploited by an attacker to gain unauthorized access or escalate privileges. The vulnerability affects Ansible Engine versions 2.7.18, 2.8.12, and 2.9.9, as well as previous versions, and Ansible Tower versions 3.4.5, 3.5.6, and 3.6.4, as well as previous versions.

How To Fix

Latest published version: 14.5.0 as of 22 Oct 2026

pip install --upgrade "ansible==14.5.0"

Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.

If you can't move to the latest

The minimum fixed version depends on the release line you run.

>= 2.7.0, < 2.8.0a1 2.8.0a1

pip install --upgrade "ansible==2.8.0a1"

>= 2.8.0, < 2.8.13 2.8.13
```
pip install --upgrade "ansible==2.8.13"
```
>= 2.9.0, < 2.9.10 2.9.10
```
pip install --upgrade "ansible==2.9.10"
```

Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →

Workaround

There is no specific workaround provided for this vulnerability. However, users can mitigate the risk by ensuring that their systems do not use ACLs and FUSE filesystems. Additionally, implementing proper access controls and monitoring mechanisms can help detect and prevent unauthorized access attempts.

Conclusion

In conclusion, the CVE-2020-10744 vulnerability in Ansible exposes systems to potential unauthorized access and privilege escalation. It is crucial for users to update their Ansible installations to the latest fixed versions and regularly apply security patches. Implementing proper access controls and monitoring mechanisms can further enhance the security of Ansible deployments. For further support and assistance in vulnerability remediation, you can contact DevNack.com.

See every vulnerability recorded for ansible →

FAQ

What is the impact of this vulnerability?

The vulnerability could allow an attacker to gain unauthorized access to sensitive information or escalate their privileges on systems running vulnerable versions of Ansible.

Are all versions of Ansible affected?

No, only Ansible Engine versions 2.7.18, 2.8.12, and 2.9.9, as well as previous versions, and Ansible Tower versions 3.4.5, 3.5.6, and 3.6.4, as well as previous versions, are affected. It is recommended to update to the latest fixed version.

Is there a known exploit for this vulnerability?

There is no known exploit publicly available at the time of this advisory. However, it is crucial to apply the necessary updates and security patches to mitigate the risk.

How can I check if my Ansible installation is affected?

You can use the Vulert Playground (https://vulert.com/scanner) to check if your Ansible installation is affected by this vulnerability. Simply upload your Pipfile.lock and the tool will provide real-time alerts for any open-source vulnerabilities, including CVE-2020-10744.

Where can I find more information about this vulnerability?

For more detailed information about this vulnerability, you can refer to the official advisory on the PyPI Advisory Database: [link to advisory]

References

Related vulnerabilities

Recent vulnerabilities recorded for ansible.

View all ansible vulnerabilities →