Remote Code Execution in Ansible community.general Memcached Plugin

The community.general Ansible collection contains a vulnerability in its memcached cache plugin that exposes Ansible controllers to remote code execution. Although the plugin documentation implies records are stored in JSON, it lacks explicit serialization, relying instead on python-memcached. This library defaults to pickling values during write operations and unpickling them upon retrieval. Because memcached instances frequently lack authentication and cache keys are often predictable, an attacker with network access to the memcached server can inject a crafted pickle payload. When the Ansible controller attempts to retrieve a fact from the poisoned cache, the deserialization process triggers arbitrary code execution. This vulnerability is critical in environments where memcached instances are shared or exposed to untrusted network segments.

Impact

The vulnerability results in full remote code execution on the Ansible controller, potentially granting an attacker complete control over the automation environment. This allows for the manipulation of infrastructure, theft of secrets, and horizontal movement within the target network. The impact is significant for organizations relying on Ansible for large-scale configuration management.

Recommendation

• Audit all Ansible controller configurations to identify usage of the memcached cache plugin.
• Implement strict network access control lists (ACLs) to ensure that memcached instances are not accessible from unauthorized segments or untrusted hosts.
• Upgrade the community.general Ansible collection to the latest patched version when available.
• Transition from unauthenticated memcached instances to configurations that enforce authentication or encryption if the environment allows.