CVE-2020-1738: Red Hat Ansible

Low severity, CVSS 3.9. EPSS: 0.4% chance of exploitation in the next 30 days.

A flaw was found in Ansible Engine when the module package or service is used and the parameter 'use' is not specified. If a previous task is executed with a malicious user, the module sent can be selected by the attacker using the ansible facts file. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable.

Affected products

• Red Hat Ansible: up to and including 2.7.16; from 2.8.0, up to and including 2.8.8; from 2.9.0, up to and including 2.9.5
• Red Hat Ansible Tower: up to and including 3.3.4; from 3.3.5, up to and including 3.4.5; from 3.5.0, up to and including 3.5.5; from 3.6.0, up to and including 3.6.3
• Red Hat Cloudforms Management Engine: version 5.0 only
• Red Hat Openstack: version 13 only

Published 2020-03-16. Last modified 2026-06-17.