CVE-2018-16879: Red Hat Ansible Tower

Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days.

Ansible Tower before version 3.3.3 does not set a secure channel as it is using the default insecure configuration channel settings for messaging celery workers from RabbitMQ. This could lead in data leak of sensitive information such as passwords as well as denial of service attacks by deleting projects or inventory files.

Affected products

• Red Hat Ansible Tower: before 3.3.3 (fixed in 3.3.3)

Published 2019-01-03. Last modified 2026-06-17.