CVE-2023-5764

What it actually does

The flaw allows internal templating operations in Ansible to strip the unsafe designation from user-supplied template data, enabling template injection that can execute arbitrary code or access sensitive data on the controller.

Why it matters to the business

Attackers could gain control over automation workflows, leading to unauthorized execution of tasks, exposure of credentials or secrets, and potential compromise of managed infrastructure with high operational disruption.

How an attack unfolds

An attacker with local access supplies a specially crafted file containing template data to the Ansible controller; the internal templating logic removes the unsafe marker, allowing the injected template to be processed and executed during controller operations.

How to fix it

Upgrade ansible/ansible to the fixed commit 1acaaadd0bcb416237410050dfd1ab1eeaabc046 or later release that restores proper unsafe designation handling for template data.

How to confirm the fix worked

Confirm the installed Ansible version includes commit 1acaaadd0bcb416237410050dfd1ab1eeaabc046; test templating operations with known unsafe data patterns to verify designation is preserved.

Typical attack path

1. Obtain local access or ability to supply templating data to the Ansible controller
2. Prepare and submit a malicious file designed to trigger unsafe template handling
3. Trigger internal templating operations that process the supplied data
4. Execute injected template content to achieve code execution or data exfiltration

How to detect it

Review Ansible controller logs for templating operations involving user-supplied files; look for unexpected variable expansions, command executions, or changes in privilege context during template rendering.

What your security team should do

• Apply the fixed commit 1acaaadd0bcb416237410050dfd1ab1eeaabc046 immediately on all controller instances
• Audit playbooks and templates for any custom unsafe data handling that could be affected
• Monitor for unexpected template execution or elevated privileges during automation runs
• Restrict local access to the controller to only trusted users until patched