Medium
Security advisory
A flaw was discovered in the way Ansible templating was implemented in versions before 2.6.18, 2.7.12 and 2.8.2, causing the possibility of information disclosure through unexpected variable substitution. By taking advantage of unintended variable substitution the content of any variable may be disclosed.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2019-10156
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 09:44 UTC · Revision 1
Source evidence
A flaw was discovered in the way Ansible templating was implemented in versions before 2.6.18, 2.7.12 and 2.8.2, causing the possibility of information disclosure through unexpected variable substitution. By taking advantage of unintended variable substitution the content of any variable may be disclosed.
osv:CVE-2019-10156
Complete source record
{
"id": "e8403597c9cec03f1055bdc0b6390445ba9dd609434a9cab4af85eb31a8459d2",
"url": "https://osv.dev/vulnerability/CVE-2019-10156",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2019-10156",
"summary": "A flaw was discovered in the way Ansible templating was implemented in versions before 2.6.18, 2.7.12 and 2.8.2, causing the possibility of information disclosure through unexpected variable substitution. By taking advantage of unintended variable substitution the content of any variable may be disclosed.",
"evidence": "osv:CVE-2019-10156",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2019-10156",
"aliases": [
"CVE-2019-10156",
"GHSA-grgm-pph5-j5h7",
"PYSEC-2019-2"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/ansible/ansible",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "a5f3791a914e5e288a519aa9f57657ebb9080fdb"
},
{
"introduced": "0a07068054090d5b78b27496aa251be74c484b45"
},
{
"fixed": "1fb35cd857b59fb07f0201abe021092a508b3efc"
},
{
"introduced": "2611867fd1dc387ceaa0ffb8ce0f030aafc2a859"
},
{
"fixed": "3affc30abef7a8e1af36a1b079f3a1fd7df363e2"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:redhat:ansible:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "2.6.18"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:redhat:ansible:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.7.0"
},
{
"fixed": "2.7.12"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:redhat:ansible:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.8.0"
},
{
"fixed": "2.8.2"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"v2.8.1",
"v2.7.11",
"v2.6.17",
"v2.8.0",
"v2.6.16",
"v2.7.10",
"v2.6.15",
"v2.7.9",
"v2.7.8",
"v2.6.14",
"v2.7.7",
"v2.6.13",
"v2.6.12",
"v2.7.6",
"v2.7.5",
"v2.6.11",
"v2.6.10",
"v2.7.4",
"v2.7.3",
"v2.6.9",
"v2.6.8",
"v2.7.2",
"v2.6.7",
"v2.7.1",
"v2.6.6",
"v2.7.0",
"v2.6.5",
"v2.6.4",
"v2.6.3",
"v2.6.2",
"v2.6.1",
"v2.6.0",
"v2.6.0rc5",
"v2.6.0rc4",
"v2.6.0rc3",
"v2.6.0rc2",
"v2.6.0rc1",
"v2.6.0a2",
"v2.6.0a1",
"v2.0.0-0.5.beta3",
"v2.0.0-0.4.beta2",
"v2.0.0-0.3.beta1",
"v2.0.0-0.2.alpha2",
"v2.0.0-0.1.alpha1",
"v1.6.0",
"v1.4.0",
"v1.2",
"v1.1",
"v1.0",
"0.7",
"0.3",
"0.0.1",
"0.01"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-10156.json"
}
}
],
"modified": "2026-10-20T10:47:45.995325331Z",
"provider": "osv",
"references": [
"https://access.redhat.com/errata/RHSA-2019:3744",
"https://access.redhat.com/errata/RHSA-2019:3789",
"https://lists.debian.org/debian-lts-announce/2019/09/msg00016.html",
"https://lists.debian.org/debian-lts-announce/2021/01/msg00023.html",
"https://www.debian.org/security/2021/dsa-4950",
"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10156",
"https://github.com/ansible/ansible/pull/57188"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"
],
"vendor_product": "debian:debian_linux",
"extracted_events": [
{
"range": [
{
"introduced": "8.0"
},
{
"last_affected": "8.0"
},
{
"introduced": "9.0"
},
{
"last_affected": "9.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:redhat:openstack:13:*:*:*:*:*:*:*",
"cpe:2.3:a:redhat:openstack:14:*:*:*:*:*:*:*"
],
"vendor_product": "redhat:openstack",
"extracted_events": [
{
"range": [
{
"introduced": "13"
},
{
"last_affected": "13"
},
{
"introduced": "14"
},
{
"last_affected": "14"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2019-10156",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 379684,
"published_at": "2019-07-30T23:15:12.043+00:00"
}