{"id":"CVE-2026-87874","title":"A flaw was found in the memcached cache plugin of the community.general Ansible\ncollection","summary":"A flaw was found in the memcached cache plugin of the community.general Ansible\ncollection. Although its documentation states that records are stored in JSON\nformat, the plugin performs no explicit serialization and relies on\npython-memc…","severity":"high","cvss":8.1,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-502"],"vendor":"Red Hat","product":"ansible-collection-community-general","affected":["ansible-collection-community-general (all versions)","ansible-collection-community-general (all versions)","ansible-collection-community-general (all versions)","ansible-collection-community-general (all versions)"],"published":"2026-09-09","updated":"2026-09-09","sourceUpdated":"2026-09-09T20:13:26.720","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87874","references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-87874","label":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2530995","label":"secalert@redhat.com"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-87874.json"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-87874"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87874"}],"tags":["nvd","cve.org","csaf","vex","red-hat"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-09-09T16:58:33.648402Z"},"ingestedAt":"2026-09-10T16:47:44.277Z","epss":0.00426,"epssPercentile":0.36343,"slug":"CVE-2026-87874","body":"## Overview\n\nA flaw was found in the memcached cache plugin of the community.general Ansible\ncollection. Although its documentation states that records are stored in JSON\nformat, the plugin performs no explicit serialization and relies on\npython-memcached, which pickles values on write and unpickles them on read.\nBecause memcached is unauthenticated and cache keys are predictable, an attacker\nable to reach a network-exposed or shared memcached instance can write a crafted\npickle payload that is deserialized and executed on the Ansible controller when\nthe poisoned fact cache is next read, leading to remote code execution.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Red Hat Ceph Storage 5, Red Hat Ceph Storage 9, Red Hat OpenStack Platform 17.1, Red Hat OpenStack Platform 18.0 · no fix planned: Red Hat Ceph Storage 5, Red Hat Ceph Storage 9, Red Hat OpenStack Platform 17.1, Red Hat OpenStack Platform 18.0 · updated 2026-09-10 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-87874.json)","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":44.6,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}