Unrated

DEBIAN-CVE-2026-87874

Type: advisorySource: OSV1 source record

A flaw was found in the memcached cache plugin of the community.general Ansible collection. Although its documentation states that records are stored in JSON format, the plugin performs no explicit serialization and relies on python-memcached, which pickles values on write and unpickles them on read. Because memcached is unauthenticated and cache keys are predictable, an attacker able to reach a network-exposed or shared memcached instance can write a crafted pickle payload that is deserialized and executed on the Ansible controller when the poisoned fact cache is next read, leading to remote code execution.

Announced 9 Sept 2026Source revision 1

Original source ↗

DEBIAN-CVE-2026-87874

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:DEBIAN-CVE-2026-87874

ansible

Source reference: /affected/0/package/name

Affected versions: 10.0.0+dfsg-1
Source reference: /affected/0/versions
10.0.1+dfsg-1
Source reference: /affected/0/versions
10.1.0+dfsg-1
Source reference: /affected/0/versions
10.5.0+dfsg-1
Source reference: /affected/0/versions
10.5.0+dfsg-2
Source reference: /affected/0/versions
10.6.0+dfsg-1
Source reference: /affected/0/versions
11.1.0+dfsg-1
Source reference: /affected/0/versions
11.2.0+dfsg-1
Source reference: /affected/0/versions
12.0.0+dfsg-1
Source reference: /affected/0/versions
12.0.0~a1+dfsg-1
Source reference: /affected/0/versions
12.0.0~a2+dfsg-1
Source reference: /affected/0/versions
12.0.0~a4+dfsg-1
Source reference: /affected/0/versions
12.0.0~a6+dfsg-1
Source reference: /affected/0/versions
12.0.0~b1+dfsg-1
Source reference: /affected/0/versions
12.0.0~b2+dfsg-1
Source reference: /affected/0/versions
12.0.0~b3+dfsg-1
Source reference: /affected/0/versions
12.0.0~b5+dfsg-1
Source reference: /affected/0/versions
12.2.0+dfsg-1
Source reference: /affected/0/versions
13.1.0+dfsg-1
Source reference: /affected/0/versions
13.4.0+dfsg-1
Source reference: /affected/0/versions
14.0.0+dfsg-1
Source reference: /affected/0/versions
14.0.0~a4+dfsg-1
Source reference: /affected/0/versions
14.4.0+dfsg-1
Source reference: /affected/0/versions
7.3.0+dfsg-1
Source reference: /affected/0/versions
7.7.0+dfsg-1
Source reference: /affected/0/versions
7.7.0+dfsg-2
Source reference: /affected/0/versions
7.7.0+dfsg-3
Source reference: /affected/0/versions
7.7.0+dfsg-3+deb12u1
Source reference: /affected/0/versions
9.4.0+dfsg-1
Source reference: /affected/0/versions
9.5.1+dfsg-1
Source reference: /affected/0/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

ansible

Source reference: /affected/1/package/name

Affected versions: 12.0.0+dfsg-0+deb13u1
Source reference: /affected/1/versions
12.0.0+dfsg-1
Source reference: /affected/1/versions
12.0.0~a6+dfsg-1
Source reference: /affected/1/versions
12.0.0~b1+dfsg-1
Source reference: /affected/1/versions
12.0.0~b2+dfsg-1
Source reference: /affected/1/versions
12.0.0~b3+dfsg-1
Source reference: /affected/1/versions
12.0.0~b5+dfsg-0+deb13u1
Source reference: /affected/1/versions
12.0.0~b5+dfsg-1
Source reference: /affected/1/versions
12.2.0+dfsg-1
Source reference: /affected/1/versions
13.1.0+dfsg-1
Source reference: /affected/1/versions
13.4.0+dfsg-1
Source reference: /affected/1/versions
14.0.0+dfsg-1
Source reference: /affected/1/versions
14.0.0~a4+dfsg-1
Source reference: /affected/1/versions
14.4.0+dfsg-1
Source reference: /affected/1/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

ansible

Source reference: /affected/2/package/name

Affected versions: 12.0.0+dfsg-1
Source reference: /affected/2/versions
12.0.0~a6+dfsg-1
Source reference: /affected/2/versions
12.0.0~b1+dfsg-1
Source reference: /affected/2/versions
12.0.0~b2+dfsg-1
Source reference: /affected/2/versions
12.0.0~b3+dfsg-1
Source reference: /affected/2/versions
12.0.0~b5+dfsg-1
Source reference: /affected/2/versions
12.2.0+dfsg-1
Source reference: /affected/2/versions
13.1.0+dfsg-1
Source reference: /affected/2/versions
13.4.0+dfsg-1
Source reference: /affected/2/versions
14.0.0+dfsg-1
Source reference: /affected/2/versions
14.0.0~a4+dfsg-1
Source reference: /affected/2/versions
14.4.0+dfsg-1
Source reference: /affected/2/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "ansible",
      "purl": "pkg:deb/debian/ansible?arch=source&distro=bookworm",
      "ecosystem": "Debian:12"
    },
    "versions": [
      "10.0.0+dfsg-1",
      "10.0.1+dfsg-1",
      "10.1.0+dfsg-1",
      "10.5.0+dfsg-1",
      "10.5.0+dfsg-2",
      "10.6.0+dfsg-1",
      "11.1.0+dfsg-1",
      "11.2.0+dfsg-1",
      "12.0.0+dfsg-1",
      "12.0.0~a1+dfsg-1",
      "12.0.0~a2+dfsg-1",
      "12.0.0~a4+dfsg-1",
      "12.0.0~a6+dfsg-1",
      "12.0.0~b1+dfsg-1",
      "12.0.0~b2+dfsg-1",
      "12.0.0~b3+dfsg-1",
      "12.0.0~b5+dfsg-1",
      "12.2.0+dfsg-1",
      "13.1.0+dfsg-1",
      "13.4.0+dfsg-1",
      "14.0.0+dfsg-1",
      "14.0.0~a4+dfsg-1",
      "14.4.0+dfsg-1",
      "7.3.0+dfsg-1",
      "7.7.0+dfsg-1",
      "7.7.0+dfsg-2",
      "7.7.0+dfsg-3",
      "7.7.0+dfsg-3+deb12u1",
      "9.4.0+dfsg-1",
      "9.5.1+dfsg-1"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-87874.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "ansible",
      "purl": "pkg:deb/debian/ansible?arch=source&distro=trixie",
      "ecosystem": "Debian:13"
    },
    "versions": [
      "12.0.0+dfsg-0+deb13u1",
      "12.0.0+dfsg-1",
      "12.0.0~a6+dfsg-1",
      "12.0.0~b1+dfsg-1",
      "12.0.0~b2+dfsg-1",
      "12.0.0~b3+dfsg-1",
      "12.0.0~b5+dfsg-0+deb13u1",
      "12.0.0~b5+dfsg-1",
      "12.2.0+dfsg-1",
      "13.1.0+dfsg-1",
      "13.4.0+dfsg-1",
      "14.0.0+dfsg-1",
      "14.0.0~a4+dfsg-1",
      "14.4.0+dfsg-1"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-87874.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "ansible",
      "purl": "pkg:deb/debian/ansible?arch=source&distro=forky",
      "ecosystem": "Debian:14"
    },
    "versions": [
      "12.0.0+dfsg-1",
      "12.0.0~a6+dfsg-1",
      "12.0.0~b1+dfsg-1",
      "12.0.0~b2+dfsg-1",
      "12.0.0~b3+dfsg-1",
      "12.0.0~b5+dfsg-1",
      "12.2.0+dfsg-1",
      "13.1.0+dfsg-1",
      "13.4.0+dfsg-1",
      "14.0.0+dfsg-1",
      "14.0.0~a4+dfsg-1",
      "14.4.0+dfsg-1"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-87874.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  }
]

Publisher severity

No explicit severity was provided.

Event: #58524 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 18:11:25 GMT
Publisher date: Wed, 09 Sep 2026 17:17:53 GMT

Read the original announcement