CyberRota Analysis
AI-GeneratedThe memcached cache plugin in the community.general Ansible collection is vulnerable due to improper serialization, allowing an attacker to exploit predictable cache keys in unauthenticated instances. This flaw can lead to remote code execution when a crafted pickle payload is deserialized on the Ansible controller. Organizations using this Ansible collection, particularly those with exposed memcached instances, should prioritize patching to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A flaw was found in the memcached cache plugin of the community.general Ansible collection. Although its documentation states that records are stored in JSON format, the plugin performs no explicit serialization and relies on python-memcached, which pickles values on write and unpickles them on read. Because memcached is unauthenticated and cache keys are predictable, an attacker able to reach a network-exposed or shared memcached instance can write a crafted pickle payload that is deserialized and executed on the Ansible controller when the poisoned fact cache is next read, leading to remote code execution.