← Vulnerability feed

Vulnerability record · CVE-2017-7466 · published 22 June 2018

CVE-2017-7466: Redhat ansible improper input validation vulnerability

Redhat · Ansible

Ansible before version 2.3 has an input validation vulnerability in the handling of data sent from client systems. An attacker with control over a client system being managed by Ansible, and the ability to send facts back to the Ansible server, could use this flaw to execute arbitrary code on the Ansible server using the Ansible server privileges.

8.0 CVSS 3.0 High EPSS 3.1% · top 12.6% CWE-20 · Improper input validation
8.0CVSS 3.0 base score, v2 8.5
3.1%EPSS exploitation probability, 30 days
NoNot in CISA KEV
2Affected product versions listed by NVD
16References
17 Jun 2026Last modified by NVD

Description

Ansible before version 2.3 has an input validation vulnerability in the handling of data sent from client systems. An attacker with control over a client system being managed by Ansible, and the ability to send facts back to the Ansible server, could use this flaw to execute arbitrary code on the Ansible server using the Ansible server privileges.

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://www.securityfocus.com/bid/97595 Third Party AdvisoryVDB Entry
https://access.redhat.com/errata/RHSA-2017:1244 Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:1334 Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:1476 Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:1499 Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:1599 Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:1685 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7466 Issue TrackingThird Party Advisory
http://www.securityfocus.com/bid/97595 Third Party AdvisoryVDB Entry
https://access.redhat.com/errata/RHSA-2017:1244 Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:1334 Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:1476 Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:1499 Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:1599 Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:1685 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7466 Issue TrackingThird Party Advisory

Track CVE-2017-7466 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2017-2637Redhat openstack missing authentication for critical function vulnerabilityA design flaw issue was found in the Red Hat OpenStack Platform director use of TripleO to enable libvirtd based live-migration. Libvirtd is deployed…EPSS 4.8%10.0CVE-2015-1842Redhat openstack vulnerabilityThe puppet manifests in the Red Hat openstack-puppet-modules package before 2014.2.13-2 uses a default password of CHANGEME for the pcsd daemon, whic…EPSS 5.2%9.9CVE-2016-9603Qemu heap-based buffer overflow vulnerabilityA heap buffer overflow flaw was found in QEMU's Cirrus CLGD 54xx VGA emulator's VNC display driver support before 2.9; the issue could occur when a V…EPSS 4.4%9.9CVE-2017-2620Qemu out-of-bounds write vulnerabilityQuick emulator (QEMU) before 2.8 built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The issue could…EPSS 3.6%9.8CVE-2014-4657Redhat ansible improper input validation vulnerabilityThe safe_eval function in Ansible before 1.5.4 does not properly restrict the code subset, which allows remote attackers to execute arbitrary code vi…EPSS 4.4%9.8CVE-2014-4678Redhat ansible injection vulnerabilityThe safe_eval function in Ansible before 1.6.4 does not properly restrict the code subset, which allows remote attackers to execute arbitrary code vi…EPSS 5.2%9.8CVE-2014-4966Redhat ansible injection vulnerabilityAnsible before 1.6.7 does not prevent inventory data with "{{" and "lookup" substrings, and does not prevent remote data with "{{" substrings, which …EPSS 3.6%9.8CVE-2014-4967Redhat ansible injection vulnerabilityMultiple argument injection vulnerabilities in Ansible before 1.6.7 allow remote attackers to execute arbitrary code by leveraging access to an Ansib…EPSS 3.6%

Source: NIST National Vulnerability Database (record CVE-2017-7466), CISA KEV, FIRST EPSS (scores of 2026-09-28). This page is refreshed as NVD updates the record.