{"cve":"CVE-2016-9587","nvd":{"published":"2018-04-24T16:29:00.220","modified":"2026-06-17T00:56:17.670","status":"Modified","description":"Ansible before versions 2.1.4, 2.2.1 is vulnerable to an improper input validation in Ansible's handling of data sent from client systems. An attacker with control over a client system being managed by Ansible and the ability to send facts back to the Ansible server could use this flaw to execute arbitrary code on the Ansible server using the Ansible server privileges.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","score":8.1},"cwes":["CWE-20"],"references":["http://rhn.redhat.com/errata/RHSA-2017-0195.html","http://rhn.redhat.com/errata/RHSA-2017-0260.html","http://www.securityfocus.com/bid/95352","https://access.redhat.com/errata/RHSA-2017:0448","https://access.redhat.com/errata/RHSA-2017:0515"],"products":["ansible:ansible","redhat:ansible","redhat:openstack"],"source":"nvd","synced_at":"2026-10-19T20:49:59.483420567+00:00"},"epss":{"cve":"CVE-2016-9587","score":0.1714,"percentile":0.97089,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-m956-frf4-m2wr","url":"https://osv.dev/vulnerability/GHSA-m956-frf4-m2wr","summary":"Ansible is vulnerable to an improper input validation in Ansible's handling of data sent from client systems","modified":"2024-11-25T05:23:01.633323Z","packages":[{"ecosystem":"PyPI","name":"ansible","purl":"pkg:pypi/ansible","ranges":["<2.1.4.0"],"fixed":["2.1.4.0"]},{"ecosystem":"PyPI","name":"ansible","purl":"pkg:pypi/ansible","ranges":[">=2.2.0.0 <2.2.1.0"],"fixed":["2.2.1.0"]}]},{"id":"PYSEC-2018-39","url":"https://osv.dev/vulnerability/PYSEC-2018-39","summary":"","modified":"2023-11-08T03:58:38.355952Z","packages":[{"ecosystem":"PyPI","name":"ansible","purl":"pkg:pypi/ansible","ranges":["<2.1.4.0",">=2.2.0.0 <2.2.1.0"],"fixed":["2.1.4.0","2.2.1.0"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}