High [CVE-2026-87874] memcached cache plugin deserializes untrusted pickle data from memcached, enabling cache-poisoning remote code execution on the Ansible controller
This high-severity Red Hat Linux advisory covers CVE-2026-87874 affecting Red Hat Ceph Storage 5, Red Hat Ceph Storage 9, Red Hat OpenStack Platform 17.1.
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
A flaw was found in the memcached cache plugin of the community.general Ansible collection. Although its documentation states that records are stored in JSON format, the plugin performs no explicit serialization and relies on python-memcached, which pickles values on write and unpickles them on read.
Because memcached is unauthenticated and cache keys are predictable, an attacker able to reach a network-exposed or shared memcached instance can write a crafted pickle payload that is deserialized and executed on the Ansible controller when the poisoned fact cache is next read, leading to remote code execution.
This issue affects the community.general collection, which is community- maintained content and is not shipped in a Red Hat-supported execution environment for Ansible Automation Platform, nor in RHEL AppStream.
Exploitation requires a non-default, insecure deployment (a reachable, unauthenticated memcached shared across a trust boundary); with memcached isolated to the controller there is no security impact. Red Hat severity: Moderate — CVSS 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
Weakness: CWE-502. Affected Red Hat products: Red Hat Ceph Storage 5; Red Hat Ceph Storage 9; Red Hat OpenStack Platform 17.1; Red Hat OpenStack Platform 18.0.
Red Hat does not currently list a fixing RHSA for this CVE.
Affected versions
No affected-version range was extracted from the source record. The vendor advisory is authoritative — check it before change work.
Official advisory · high-confidence parse· fetched 1 hour ago·verify at source
Fixed versions
No fixed release is recorded yet. That does not prove no patch exists — confirm against the vendor advisory.
Official advisory · high-confidence parse· fetched 1 hour ago·verify at source
Mitigation checklist
- Bind memcached to localhost only (the plugin default, 127.0.0.1:11211) and never expose an unauthenticated memcached across a trust boundary; isolate the cache to the controller. Prefer the redis cache plugin (explicit JSON) or the jsonfile/yaml cache plugins where a shared/remote fact cache is required. Treat any host with write access to the fact-cache memcached as trusted to run code on the controller.
Official advisory · high-confidence parse· fetched 1 hour ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.