Remote Code Execution Vulnerability in Memcached Cache Plugin of Ansible

CVE-2026-87874

What is CVE-2026-87874?

A significant flaw exists in the memcached cache plugin of the Ansible Community General Collection. The plugin documents that records should be stored in JSON format; however, it lacks explicit serialization, relying instead on python-memcached, which uses pickling on both write and read operations. This absence of authentication for memcached, combined with predictable cache keys, allows an attacker to exploit a network-exposed or shared memcached instance. By injecting a malicious pickle payload, the attacker can execute arbitrary code on the Ansible controller when the compromised cache is accessed. This vulnerability underscores serious risks related to improper handling of serialized data and insufficient security measures in caching mechanisms.

References