---
id: CVE-2026-87874
title: >-
  A flaw was found in the memcached cache plugin of the community.general
  Ansible

  collection
summary: >-
  A flaw was found in the memcached cache plugin of the community.general
  Ansible

  collection. Although its documentation states that records are stored in JSON

  format, the plugin performs no explicit serialization and relies on

  python-memc…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-502
vendor: Red Hat
product: ansible-collection-community-general
affected:
  - ansible-collection-community-general (all versions)
  - ansible-collection-community-general (all versions)
  - ansible-collection-community-general (all versions)
  - ansible-collection-community-general (all versions)
published: '2026-09-09'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T20:13:26.720'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-87874'
references:
  - url: 'https://access.redhat.com/security/cve/CVE-2026-87874'
    label: secalert@redhat.com
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2530995'
    label: secalert@redhat.com
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-87874.json
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-87874'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-87874'
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-09T16:58:33.648402Z'
ingestedAt: '2026-09-10T16:47:44.277Z'
epss: 0.00721
epssPercentile: 0.51945
---

## Overview

A flaw was found in the memcached cache plugin of the community.general Ansible
collection. Although its documentation states that records are stored in JSON
format, the plugin performs no explicit serialization and relies on
python-memcached, which pickles values on write and unpickles them on read.
Because memcached is unauthenticated and cache keys are predictable, an attacker
able to reach a network-exposed or shared memcached instance can write a crafted
pickle payload that is deserialized and executed on the Ansible controller when
the poisoned fact cache is next read, leading to remote code execution.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat Ceph Storage 5, Red Hat Ceph Storage 9, Red Hat OpenStack Platform 17.1, Red Hat OpenStack Platform 18.0 · no fix planned: Red Hat Ceph Storage 5, Red Hat Ceph Storage 9, Red Hat OpenStack Platform 17.1, Red Hat OpenStack Platform 18.0 · updated 2026-09-10 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-87874.json)