Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-87874— Community.general: community.general: memcached cache plugin deserializes untrusted pickle data from memcached, enabling cache-poisoning remote code execution on the ansible controller

Quick assessment

Affected
Red Hat Red Hat Ceph Storage 5
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Ansible 集合中的 memcached 缓存插件中发现了一个缺陷。尽管其文档声称记录以 JSON 格式存储，但该插件并未进行显式的序列化操作，而是依赖 库，该库在写入时使用 pickle 进行序列化，在读取时进行反序列化。 由于 memcached 服务通常无需身份验证，且缓存键是可预测的，攻击者如果能够访问暴露于网络或共享环境中的 memcached 实例，可以写入一个经过构造的 pickle 载荷。当被污染的 fact 缓存下次被读取时，该载荷会在 Ansible 控制器上被反序列化并执行，从而导致远

CVSS 8.1 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-87874

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Community.general: community.general: memcached cache plugin deserializes untrusted pickle data from memcached, enabling cache-poisoning remote code execution on the ansible controller
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in the memcached cache plugin of the community.general Ansible collection. Although its documentation states that records are stored in JSON format, the plugin performs no explicit serialization and relies on python-memcached, which pickles values on write and unpickles them on read. Because memcached is unauthenticated and cache keys are predictable, an attacker able to reach a network-exposed or shared memcached instance can write a crafted pickle payload that is deserialized and executed on the Ansible controller when the poisoned fact cache is next read, leading to remote code execution.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
可信数据的反序列化
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Red Hat Red Hat Ceph Storage 5 - cpe:/a:redhat:ceph_storage:5
Red Hat Red Hat Ceph Storage 9 - cpe:/a:redhat:ceph_storage:9
Red Hat Red Hat OpenStack Platform 17.1 - cpe:/a:redhat:openstack:17.1
Red Hat Red Hat OpenStack Platform 18.0 - cpe:/a:redhat:openstack:18.0

II. Public POCs for CVE-2026-87874

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-87874

请登录查看更多情报信息。

Other References for CVE-2026-87874 (2)

Same Patch Batch · Red Hat · 2026-09-09 · 8 CVEs total

CVE-2026-87766 8.8 HIGH Bubblewrap: bubblewrap: symlink traversal via /oldroot allows writing files outside sandbo
CVE-2026-18147 8.1 HIGH Freeipa: ipa: freeipa/idm: cross-site scripting vulnerability allows arbitrary code execut
CVE-2026-87853 7.5 HIGH Sssd: sssd: idp authentication prefix comparison allows cross-user impersonation
CVE-2026-87872 6.8 MEDIUM Community.general: community.general: ocapi module_utils (ocapi_command, ocapi_info) hardc
CVE-2026-19729 4.9 MEDIUM Keycloak-services: keycloak-services: incomplete fix for arbitrary filesystem path probing
CVE-2026-87875 4.3 MEDIUM Cups: openprinting cups: heap out-of-bounds read in cupsutf32toutf8() via missing source-l
CVE-2026-87876 3.0 LOW Cups: openprinting cups: remaining case-insensitive username matching in scheduler side pa

IV. Related Vulnerabilities

Same product: Red Hat Ceph Storage 5
Same vendor: Red Hat
Same weakness: CWE-502

V. Comments for CVE-2026-87874

No comments yet

Leave a comment