A flaw was found in Ansible-Core. This vulnerability allows attackers to bypass unsafe content protections using the hostvars object to reference and execute templated content. This issue can lead to arbitrary code execution if remote data or module outputs are improperly templated within playbooks.

The remote NewStart CGSL host, running version MAIN 6.06, has ansible-core packages installed that are affected by multiple vulnerabilities:

  - A flaw was found in Ansible. The ansible-core `user` module can allow an unprivileged user to silently     create or replace the contents of any file on any system path and take ownership of it when a privileged     user executes the `user` module against the unprivileged user's home directory. If the unprivileged user     has traversal permissions on the directory containing the exploited target file, they retain full control     over the contents of the file as its owner. (CVE-2024-9902)

  - A flaw was found in Ansible-Core. This vulnerability allows attackers to bypass unsafe content protections     using the hostvars object to reference and execute templated content. This issue can lead to arbitrary     code execution if remote data or module outputs are improperly templated within playbooks.
    (CVE-2024-11079)

  - A flaw was found in Ansible, where sensitive information stored in Ansible Vault files can be exposed in     plaintext during the execution of a playbook. This occurs when using tasks such as include_vars to load     vaulted variables without setting the no_log: true parameter, resulting in sensitive data being printed in     the playbook output or logs. This can lead to the unintentional disclosure of secrets like passwords or     API keys, compromising security and potentially allowing unauthorized access or actions. (CVE-2024-8775)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has a package installed that is affected by a vulnerability as referenced in the dla-4502 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4502-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                          Lee Garrett     March 17, 2026                                https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : ansible     Version        : 2.10.7+merged+base+2.10.17+dfsg-0+deb11u4     CVE ID         : CVE-2024-11079     Debian Bug     : 1088106

    A flaw was found in ansible, a configuration management, deployment, and task     execution system. This vulnerability allows attackers to bypass unsafe content     protections using the hostvars object to reference and execute templated     content. This issue can lead to arbitrary code execution if remote data or     module outputs are improperly templated within playbooks.

    For Debian 11 bullseye, this problem has been fixed in version     2.10.7+merged+base+2.10.17+dfsg-0+deb11u4.

    We recommend that you upgrade your ansible packages.

    For the detailed security status of ansible please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/ansible

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2025-2842f20915 advisory.

    https://fedoraproject.org/wiki/Changes/Ansible13

    - Close old CVE bugs
    - Close bogus Markdown-It CVE bug
    - Close unactionable ABRT bug

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2025:0626 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2024-11079:
    A flaw was found in Ansible-Core. This vulnerability allows attackers to bypass unsafe content protections     using the hostvars object to reference and execute templated content. This issue can lead to arbitrary     code execution if remote data or module outputs are improperly templated within playbooks.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 7.02, has ansible-core packages installed that are affected by multiple vulnerabilities:

  - An information disclosure flaw was found in ansible-core due to a failure to respect the ANSIBLE_NO_LOG     configuration in some scenarios. Information is still included in the output in certain tasks, such as     loop items. Depending on the task, this issue may include sensitive information, such as decrypted secret     values. (CVE-2024-0690)

  - A flaw was found in Ansible-Core. This vulnerability allows attackers to bypass unsafe content protections     using the hostvars object to reference and execute templated content. This issue can lead to arbitrary     code execution if remote data or module outputs are improperly templated within playbooks.
    (CVE-2024-11079)

  - A flaw was found in Ansible, where sensitive information stored in Ansible Vault files can be exposed in     plaintext during the execution of a playbook. This occurs when using tasks such as include_vars to load     vaulted variables without setting the no_log: true parameter, resulting in sensitive data being printed in     the playbook output or logs. This can lead to the unintentional disclosure of secrets like passwords or     API keys, compromising security and potentially allowing unauthorized access or actions. (CVE-2024-8775)

  - A flaw was found in Ansible. The ansible-core `user` module can allow an unprivileged user to silently     create or replace the contents of any file on any system path and take ownership of it when a privileged     user executes the `user` module against the unprivileged user's home directory. If the unprivileged user     has traversal permissions on the directory containing the exploited target file, they retain full control     over the contents of the file as its owner. (CVE-2024-9902)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A flaw was found in Ansible-Core. This vulnerability allows attackers to bypass unsafe content protections
    using the hostvars object to reference and execute templated content. This issue can lead to arbitrary
    code execution if remote data or module outputs are improperly templated within playbooks.
    (CVE-2024-11079)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in Ansible-Core. This vulnerability allows attackers to bypass unsafe content protections     using the hostvars object to reference and execute templated content. This issue can lead to arbitrary     code execution if remote data or module outputs are improperly templated within playbooks.
    (CVE-2024-11079)

Note that Nessus relies on the presence of the package as reported by the vendor.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-860 advisory.

    This vulnerability allows attackers to bypass unsafe content protections using the hostvars object to     reference and execute templated content. This issue can lead to arbitrary code execution if remote data or     module outputs are improperly templated within playbooks. (CVE-2024-11079)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:11145 advisory.

    Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing     IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to     individual teams, while automation developers retain the freedom to write tasks that leverage existing     knowledge without the overhead. Ansible Automation Platform makes it possible for users across an     organization to share, vet, and manage automation content by means of a simple, powerful, and agentless     language.

    Security Fix(es):

    * ansible-core: Unsafe Tagging Bypass via hostvars Object in Ansible-Core (CVE-2024-11079)
    * automation-gateway: Improper Scope Handling in OAuth2 Tokens for AAP 2.5 (CVE-2024-11483)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE page(s)     listed in the References section.

    Updates and fixes included:

    Automation Platform UI
    * Added support for filtering job templates, jobs, and inventories by labels (AAP-36540)
    * Fixed an issue where it was not possible to open a job template after removing the user which created     the template (AAP-35820)
    * Fixed an issue where the inventory source update failed, and did not allow selection of the inventory     file (AAP-35246)
    * Fixed an issue where the Login Redirect Override setting was missing and not functioning as expected     (AAP-33295)
    * Disabled auto complete for secret credential fields (AAP-33188)
    * Fixed an issue where users were able to select a credential that required a password when defining a     schedule (AAP-32821)
    * Fixed the navigation Team -> roles -> eda to the created team role page, where it did not work after     adding a new team role.(AAP-31873)
    * When configuring an Ansible Remote to sync collections from other servers, a requirements file is only     required for syncs from Galaxy, and optional otherwise. Without a requirements file, all collections get     synced (AAP-31238)
    * Fixed an issue where the job output did not show unless you switched tabs (AAP-31125)
    * Fixed an issue where the bulk removal of selected role permissions disappeared when more than 4     permissions were selected (AAP-28030)

    Event-Driven Ansible
    * Fixed an issue where the project sync would not fail on an empty or unstructured git repository     (AAP-35777)
    * Fixed an issue in the collection where the activation module failed with a misleading error message if     the rulebook, project, decision environment, or organization could not be found (AAP-35360)
    * Fixed an issue where rulebook validation import/sync fails when a rulebook has a duplicated rule name     (AAP-35164)
    * Added validation that a host specified as part of a container registry credential conforms to container     registry standards (AAP-34969)
    * Fixed an issue where the Event Driven Ansible API allowed a credentials type to be changed     (AAP-34968)
    * Fixed an issue where a previously failed project could be accidentally changed to completed after a     resync (AAP-34744)
    * Fixed an issue where no message was recorded when a project did not contain any rulebooks (AAP-34555)
    * Fixed an issue whereby multiple Red Hat Ansible Automation Platform credentials were being attached to     activations (AAP-34025)
    * Fixed an issue where the url field of the event stream was not updated if EDA_EVENT_STREAM_BASE_URL     setting changed (AAP-33819)
    * Extended the scope of the log_level and debug settings (AAP-33669)
    * Fixed an issue where there was an erroneous dependency on the existence of an organization named Default     (AAP-33551)
    * A project can now be synced with the Event Driven Ansible collection modules (AAP-32264)
    * Fixed an issue where occasionally an activation is reported as running, before it is ready to receive     events (AAP-31225)
    * Fixed an issue where Enabled options had its own scrollbar on the Rulebook Activation Details page     (AAP-31130)
    * Added 'purge_log_records' to aap-eda-manage to clean up outdated database records (AAP-30684)
    * Fixed an issue where the status of an activation was occasionally inconsistent with the status of the     latest instance after a restart (AAP-29755)
    * Fixed an issue where the user could not edit auto-generated injector vars while creating Event Driven     Ansible custom credentials (AAP-29752)
    * Fixed an issue where importing a project from a non-existing branch resulted in the completed state     instead of a Failed status (AAP-29144)
    * Fixed an issue where in some cases the file_watch source plugin in an Event Driven Ansible collection     raised the QueueFull exception (AAP-29139)
    * In the Rulebook activation create form, selecting a project is now required before selecting a rulebook     (AAP-28082)
    * The Create Credentials button is now visible irrespective of whether there are any existing credentials     or not (AAP-23707)
    * automation-eda-controller has been updated to 1.1.3
    * ansible-rulebook has been updated to 1.1.2

    Container-based Ansible Automation Platform
    * Fixed an issue that allowed Automation controller nodes to override the receptor_peers variable     (AAP-37085)
    * Fixed an issue where the containerized installer ignored receptor_type for automation controller hosts     and always installed them as hybrid (AAP-37012)
    * Fixed an issue where Podman was not present in the task container, and the cleanup image task failed     (AAP-37011)
    * Fixed an issue where receptor_type and receptor_protocol variables validation checks were skipped during     the preflight role execution (AAP-36857)
    * Fixed an issue where only one Automation controller node was configured with Execution/Hop node peers     rather than all Automation controller nodes (AAP-36851)
    * Fixed an issue when the Automation Controller services loose connection to the database then containers     are stopped and never started back automatically (AAP-36850)
    * containerized installer setup has been updated to 2.5-7

    Additional changes:
    * Added help text to all missing fields in AAP API gateway and django-ansible-base (AAP-37068)
    * Consistently formatted sentence structure for help_text, and provided more context in the help text     where it was vagueConsistently formatted sentence structure for help_text, and provided more context in     the help text where it was vague (AAP-37016)
    * Fixed an issue where migration was missing (AAP-37015)
    * Fixed an issue where django-ansible-base fallback cache kept creating a tmp file even if the LOCATION     was set to another path (AAP-36869)
    * Fixed an issue where the OIDC authenticator was not allowed to use the JSON key to extract user groups,     or for a user to be modified via the new GROUPS_CLAIM configuration setting (AAP-36716)
    * Fixed an issue where the gateway oauth token was not encrypted at rest (AAP-36715)
    * Added more user input validation around http_ports in gateway (AAP-36714)
    * Fixed an issue where the Gateway did not properly interpret SAML attributes for mappings (AAP-36713)
    * Added setting 'trusted_header_timeout_in_ns' to timegate X_TRUSTED_PROXY_HEADER validation in djanbo-     ansible-base libraries (AAP-36712)
    * Added dynamic preferences for usage by automation analytics (AAP-36710)
    * Added an 'enabled' flag for turning authenticator maps on or off (AAP-36709)
    * Allow non-self-signed certificate+key pairs to be used in SAML authenticator configurations (AAP-36707)
    * Make login page redirect to /api/gateway/v1 if already logged in (AAP-36638)
    * aap-metrics-utility has been updated to 0.4.1 (AAP-36393)
    * ansible-core has been updated to 2.16.14
    * automation-gateway has been updated to 2.5.20241218
    * python3.11-django-ansible-base has been updated to 2.5.20241218

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
323995	NewStart CGSL MAIN 6.06 : ansible-core Multiple Vulnerabilities (NS-SA-2026-0056)	Nessus	NewStart CGSL Local Security Checks	Local	high
302818	Debian dla-4502 : ansible - security update	Nessus	Debian Local Security Checks	Local	low
278401	Fedora 44 : ansible / ansible-core (2025-2842f20915)	Nessus	Fedora Local Security Checks	Local	medium
276026	TencentOS Server 4: ansible (TSSA-2025:0626)	Nessus	Tencent Local Security Checks	Local	low
242815	NewStart CGSL MAIN 7.02 : ansible-core Multiple Vulnerabilities (NS-SA-2025-0114)	Nessus	NewStart CGSL Local Security Checks	Local	high
421302	SCA: security update for ansible-core (GHSA-99w6-3xph-cx78)	Tenable Cloud Security	SCA Checks	Local	low
421302	SCA: security update for ansible-core (GHSA-99w6-3xph-cx78)	Tenable Self-Hosted Container Security	SCA Checks	Local	low
227971	Linux Distros Unpatched Vulnerability : CVE-2024-11079	Nessus	Misc.	Local	medium
216816	Amazon Linux 2023 : ansible-core, ansible-test (ALAS2023-2025-860)	Nessus	Amazon Linux Local Security Checks	Local	medium
213128	RHEL 8 / 9 : Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update (Moderate) (RHSA-2024:11145)	Nessus	Red Hat Local Security Checks	Local	medium

Detections

Analytics

CVE-2024-11079

low

Tenable Plugins

high

low

medium

low

high

low

low

medium

medium

medium