CVE-2018-16879

9.8 criticalEPSS 1.1%

Ansible Tower before version 3.3.3 does not set a secure channel as it is using the default insecure configuration channel settings for messaging celery workers from RabbitMQ. This could lead in data leak of sensitive information such as passwords as well as denial of service attacks by deleting projects or inventory files.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.1% chance of exploitation in the next 30 days; higher than 65% of CVEs (scores of 2026-10-31)
CWE: CWE-311
Published: 2019-01-03
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

redhat:ansible_tower

References

http://www.securityfocus.com/bid/106310
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16879
http://www.securityfocus.com/bid/106310
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16879

Check your stack JSON