CVE-2021-3583 Improper Input Validation and Command Injection in Ansible
Attackers can exploit template injection in Ansible to execute commands and disclose sensitive information via crafted facts.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-3583?
CVE-2021-3583 is a high-severity code injection vulnerability in Redhat Ansible Tower, published on 22 Sep 2021. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A flaw was found in Ansible, where a user's controller is vulnerable to template injection. This issue can occur through facts used in the template if the user is trying to put templates in multi-line YAML strings and the facts being handled do not routinely include special template characters. This flaw allows attackers to perform command injection, which discloses sensitive information. The highest threat from this vulnerability is to confidentiality and integrity.
Which versions are affected by CVE-2021-3583?
7 open source packages ship an affected version, including ansible. It affects 3 products.
| Package | Affected | Fixed in |
|---|---|---|
ansible PyPI | All versions | 2.9.23 |
ansible PyPI | All versions | 2.9.23rc1 |
ansible PyPI | All versions | 2.9.23rc1 |
ansible PyPI | From 2.10.0a1 | 2.10.11rc1 |
ansible PyPI | From 2.10.0a1 | 2.10.11rc1 |
ansible PyPI | From 2.11.0a1 | 2.11.2rc1 |
1 more packages
ansible PyPI | From 2.11.0a1 | 2.11.2rc1 |
Linux distribution packages (9)
ansible Red Hat:ansible_automation_platform:2.0::el8 | All versions | 0:2.9.23-1.el8ap |
ansible Red Hat:ansible_engine:2.9::el7 | All versions | 0:2.9.23-1.el7ae |
ansible-test Red Hat:ansible_engine:2.9::el7 | All versions | 0:2.9.23-1.el7ae |
ansible Red Hat:ansible_engine:2.9::el8 | All versions | 0:2.9.23-1.el8ae |
ansible-test Red Hat:ansible_engine:2.9::el8 | All versions | 0:2.9.23-1.el8ae |
ansible Red Hat:ansible_engine:2::el7 | All versions | 0:2.9.23-1.el7ae |
ansible-test Red Hat:ansible_engine:2::el7 | All versions | 0:2.9.23-1.el7ae |
ansible Red Hat:ansible_engine:2::el8 | All versions | 0:2.9.23-1.el8ae |
ansible-test Red Hat:ansible_engine:2::el8 | All versions | 0:2.9.23-1.el8ae |
Products include Redhat Ansible Automation Platform, Redhat Ansible Engine, Redhat Ansible Tower.
How do I fix CVE-2021-3583?
Upgrade ansible to a fixed version for your release line: 2.9.23, 2.9.23rc1, 2.10.11rc1 or 2.11.2rc1.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2021-3583 being exploited?
There is no known exploitation of CVE-2021-3583 in the wild and no public exploit code.
Other vulnerabilities in Redhat Ansible Tower
- CVE-2021-4112 Privilege escalation in ansible-tower
- CVE-2023-4237 Platform: ec2_key module prints out the private key directly to the standard output
- CVE-2025-9907 Event-driven-ansible: event stream test mode exposes sensitive headers in aap eda
- CVE-2025-9908 Event-driven-ansible: sensitive internal headers disclosure in aap eda event streams
- CVE-2025-9909 Aap-gateway: improper path validation in gateway allows credential exfiltration
Sources
Also known as AZL-6305, CLSA-2025-1748451788, DEBIAN-CVE-2021-3583, GHSA-2pfh-q76x-gwvm, OESA-2025-1647, PYSEC-2021-358 and 4 more.