Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2019-10156

21
FAUCET Score

CVE-2019-10156 is a medium-severity information disclosure vulnerability in Ansible versions prior to 2.6.18, 2.7.12, and 2.8.2, affecting various Debian and Red Hat Ansible and OpenStack deployments. The flaw stems from unexpected variable substitution during templating, which could expose the content of any variable. With a CVSS score of 5.4, this vulnerability has a low attack complexity and requires low privileges, potentially leading to limited confidentiality and integrity impacts. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.

Impacted Technologies

VendorProductVersion(s)CPE
< 2.6.18CPE matchmatch criteria
cpe:2.3:a:redhat:ansible:*:*:*:*:*:*:*:*
>= 2.7.0, < 2.7.12CPE matchmatch criteria
cpe:2.3:a:redhat:ansible:*:*:*:*:*:*:*:*
>= 2.8.0, < 2.8.2CPE matchmatch criteria
cpe:2.3:a:redhat:ansible:*:*:*:*:*:*:*:*
13CPE matchmatch criteria
cpe:2.3:a:redhat:openstack:13:*:*:*:*:*:*:*
14CPE matchmatch criteria
cpe:2.3:a:redhat:openstack:14:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.0

4.6MEDIUM

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
Exploitability Score
2.1
Impact Score
2.5
CvssVersion
3.0

Exploit Intelligence

EPSS Score
1.76%
Probability of exploitation in next 30 days
EPSS Percentile
75.6%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
This CVE's current EPSS score of 0.0176 is in the 88th percentile among its peer group of 21,974 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (20)

github_advisorypatch availablevia nvd_reference
View patch
pippatch availablevia ghsa
Product: ansibleFixed in: 2.7.12
pippatch availablevia ghsa
Product: ansibleFixed in: 2.8.2
pippatch availablevia ghsa
Product: ansibleFixed in: 2.6.18
redhatpatch availablevia redhat_api
Product: Red Hat Ansible Engine 2 for RHEL 7Fixed in: ansible-0:2.8.2-1.el7ae
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Ansible Engine 2.6 for RHEL 7Fixed in: ansible-0:2.6.18-1.el7ae
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Ansible Engine 2.7 for RHEL 7Fixed in: ansible-0:2.7.12-1.el7ae
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Ansible Engine 2.8 for RHEL 7Fixed in: ansible-0:2.8.2-1.el7ae
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Ansible Engine 2.8 for RHEL 8Fixed in: ansible-0:2.8.2-1.el8ae
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Ansible Engine 2 for RHEL 8Fixed in: ansible-0:2.8.2-1.el8ae
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenStack Platform 13.0 (Queens)Fixed in: ansible-0:2.6.19-1.el7ae
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenStack Platform 14.0 (Rocky)Fixed in: ansible-0:2.6.19-1.el7ae
View patch
debianvendor investigatingvia nvd_reference
View patch
redhatvendor investigatingvia nvd_reference
View patch
redhatno patchvia redhat_api
Product: Red Hat Ceph Storage 3Fixed in: ansible
redhatno patchvia redhat_api
Product: Red Hat Ansible Tower 3Fixed in: ansible
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux 7Fixed in: ansible
redhatend of lifevia redhat_api
Product: Red Hat Storage 3Fixed in: ansible
redhatend of lifevia redhat_api
Product: Red Hat Ceph Storage 2Fixed in: ansible
redhatend of lifevia redhat_api
Product: Red Hat OpenStack Platform 10 (Newton)Fixed in: ansible

Vendor Advisories (2)

pipGHSA-grgm-pph5-j5h7medium

Exposure of Sensitive Information to an Unauthorized Actor in ansible

Jul 31, 2019
redhatCVE-2019-10156Moderate

ansible: unsafe template evaluation of returned module data can lead to information disclosure

Jun 4, 2019

References

access.redhat.com / errata/RHSA-2019:3744
Vendor Advisory
access.redhat.com / errata/RHSA-2019:3789
Vendor Advisory
bugzilla.redhat.com / show_bug.cgi
Issue TrackingVendor Advisory
github.com / ansible/ansible/pull/57188
PatchThird Party Advisory
lists.debian.org / debian-lts-announce/2019/09/msg00016.html
Vendor Advisory
lists.debian.org / debian-lts-announce/2021/01/msg00023.html
Mailing ListThird Party Advisory
debian.org / security/2021/dsa-4950
Third Party Advisory