OPENSUSE-SU-2026:12451-1

Vulnerability from csaf_opensuse - Published: 2026-11-06 00:00 - Updated: 2026-11-07 10:41
Summary
ansible-core-2.21-2.21.6-1.1 on GA media
Severity
Moderate
Notes
Title of the patch: ansible-core-2.21-2.21.6-1.1 on GA media
Description of the patch: These are all security issues fixed in the ansible-core-2.21-2.21.6-1.1 package on the GA media of openSUSE Tumbleweed.
Patchnames: openSUSE-Tumbleweed-2026-12451
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
CVE-2023-5115
6.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N
Affected products
Product Identifier Version Remediation
Unresolved product id: openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.aarch64 —
Vendor Fix
Unresolved product id: openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.ppc64le —
Vendor Fix
Unresolved product id: openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.s390x —
Vendor Fix
Unresolved product id: openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.x86_64 —
Vendor Fix
Unresolved product id: openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.aarch64 —
Vendor Fix
Unresolved product id: openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.ppc64le —
Vendor Fix
Unresolved product id: openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.s390x —
Vendor Fix
Unresolved product id: openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.x86_64 —
Vendor Fix
Threats
Impact moderate
CVE-2023-5764
6.6 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Affected products
Recommended 8 products, the same list as for CVE-2023-5115
Threats
Impact moderate
CVE-2024-0690
5.1 (Medium)
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Recommended 8 products, the same list as for CVE-2023-5115
Threats
Impact moderate
CVE-2024-11079
5.5 (Medium)
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L
Affected products
Recommended 8 products, the same list as for CVE-2023-5115
Threats
Impact moderate
CVE-2024-8775
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected products
Recommended 8 products, the same list as for CVE-2023-5115
Threats
Impact moderate
CVE-2024-9902
6.3 (Medium)
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L
Affected products
Recommended 8 products, the same list as for CVE-2023-5115
Threats
Impact moderate
CVE-2026-105929
Affected products
Recommended 8 products, the same list as for CVE-2023-5115
Threats
Impact moderate
CVE-2026-11332
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Recommended 8 products, the same list as for CVE-2023-5115
Threats
Impact important
CVE-2026-16493
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Recommended 8 products, the same list as for CVE-2023-5115
Threats
Impact important
CVE-2026-84503
Affected products
Recommended 8 products, the same list as for CVE-2023-5115
Threats
Impact moderate
CVE-2026-89091
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Recommended 8 products, the same list as for CVE-2023-5115
Threats
Impact important
References
URL Category
https://www.suse.com/support/security/rating/ external
https://ftp.suse.com/pub/projects/security/csaf/o… self
https://www.suse.com/security/cve/CVE-2023-5115/ self
https://www.suse.com/security/cve/CVE-2023-5764/ self
https://www.suse.com/security/cve/CVE-2024-0690/ self
https://www.suse.com/security/cve/CVE-2024-11079/ self
https://www.suse.com/security/cve/CVE-2024-8775/ self
https://www.suse.com/security/cve/CVE-2024-9902/ self
https://www.suse.com/security/cve/CVE-2026-105929/ self
https://www.suse.com/security/cve/CVE-2026-11332/ self
https://www.suse.com/security/cve/CVE-2026-16493/ self
https://www.suse.com/security/cve/CVE-2026-84503/ self
https://www.suse.com/security/cve/CVE-2026-89091/ self
https://www.suse.com/security/cve/CVE-2023-5115 external
https://bugzilla.suse.com/1215606 external
https://www.suse.com/security/cve/CVE-2023-5764 external
https://bugzilla.suse.com/1216854 external
https://www.suse.com/security/cve/CVE-2024-0690 external
https://bugzilla.suse.com/1219002 external
https://www.suse.com/security/cve/CVE-2024-11079 external
https://bugzilla.suse.com/1233276 external
https://www.suse.com/security/cve/CVE-2024-8775 external
https://bugzilla.suse.com/1230601 external
https://www.suse.com/security/cve/CVE-2024-9902 external
https://bugzilla.suse.com/1233000 external
https://bugzilla.suse.com/1289627 external
https://www.suse.com/security/cve/CVE-2026-105929 external
https://bugzilla.suse.com/1289573 external
https://www.suse.com/security/cve/CVE-2026-11332 external
https://bugzilla.suse.com/1267822 external
https://bugzilla.suse.com/1272369 external
https://www.suse.com/security/cve/CVE-2026-16493 external
https://bugzilla.suse.com/1272369 external
https://www.suse.com/security/cve/CVE-2026-84503 external
https://bugzilla.suse.com/1289577 external
https://www.suse.com/security/cve/CVE-2026-89091 external
https://bugzilla.suse.com/1284847 external
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "ansible-core-2.21-2.21.6-1.1 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the ansible-core-2.21-2.21.6-1.1 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2026-12451",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_12451-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-5115 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-5115/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-5764 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-5764/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-0690 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-0690/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-11079 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-11079/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-8775 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-8775/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-9902 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-9902/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-105929 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-105929/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-11332 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-11332/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-16493 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-16493/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-84503 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-84503/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-89091 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-89091/"
      }
    ],
    "title": "ansible-core-2.21-2.21.6-1.1 on GA media",
    "tracking": {
      "current_release_date": "2026-11-07T10:41:46Z",
      "generator": {
        "date": "2026-11-06T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:12451-1",
      "initial_release_date": "2026-11-06T00:00:00Z",
      "revision_history": [
        {
          "date": "2026-11-06T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-11-07T10:41:46Z",
          "number": "2",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "ansible-core-2.21-0:2.21.6-1.1.aarch64",
                "product": {
                  "name": "ansible-core-2.21-0:2.21.6-1.1.aarch64",
                  "product_id": "ansible-core-2.21-0:2.21.6-1.1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/ansible-core-2.21@2.21.6-1.1?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ansible-test-2.21-0:2.21.6-1.1.aarch64",
                "product": {
                  "name": "ansible-test-2.21-0:2.21.6-1.1.aarch64",
                  "product_id": "ansible-test-2.21-0:2.21.6-1.1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/ansible-test-2.21@2.21.6-1.1?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "ansible-core-2.21-0:2.21.6-1.1.ppc64le",
                "product": {
                  "name": "ansible-core-2.21-0:2.21.6-1.1.ppc64le",
                  "product_id": "ansible-core-2.21-0:2.21.6-1.1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/ansible-core-2.21@2.21.6-1.1?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ansible-test-2.21-0:2.21.6-1.1.ppc64le",
                "product": {
                  "name": "ansible-test-2.21-0:2.21.6-1.1.ppc64le",
                  "product_id": "ansible-test-2.21-0:2.21.6-1.1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/ansible-test-2.21@2.21.6-1.1?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "ansible-core-2.21-0:2.21.6-1.1.s390x",
                "product": {
                  "name": "ansible-core-2.21-0:2.21.6-1.1.s390x",
                  "product_id": "ansible-core-2.21-0:2.21.6-1.1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/ansible-core-2.21@2.21.6-1.1?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ansible-test-2.21-0:2.21.6-1.1.s390x",
                "product": {
                  "name": "ansible-test-2.21-0:2.21.6-1.1.s390x",
                  "product_id": "ansible-test-2.21-0:2.21.6-1.1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/ansible-test-2.21@2.21.6-1.1?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "ansible-core-2.21-0:2.21.6-1.1.x86_64",
                "product": {
                  "name": "ansible-core-2.21-0:2.21.6-1.1.x86_64",
                  "product_id": "ansible-core-2.21-0:2.21.6-1.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/ansible-core-2.21@2.21.6-1.1?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ansible-test-2.21-0:2.21.6-1.1.x86_64",
                "product": {
                  "name": "ansible-test-2.21-0:2.21.6-1.1.x86_64",
                  "product_id": "ansible-test-2.21-0:2.21.6-1.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/ansible-test-2.21@2.21.6-1.1?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ansible-core-2.21-0:2.21.6-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.aarch64"
        },
        "product_reference": "ansible-core-2.21-0:2.21.6-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ansible-core-2.21-0:2.21.6-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.ppc64le"
        },
        "product_reference": "ansible-core-2.21-0:2.21.6-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ansible-core-2.21-0:2.21.6-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.s390x"
        },
        "product_reference": "ansible-core-2.21-0:2.21.6-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ansible-core-2.21-0:2.21.6-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.x86_64"
        },
        "product_reference": "ansible-core-2.21-0:2.21.6-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ansible-test-2.21-0:2.21.6-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.aarch64"
        },
        "product_reference": "ansible-test-2.21-0:2.21.6-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ansible-test-2.21-0:2.21.6-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.ppc64le"
        },
        "product_reference": "ansible-test-2.21-0:2.21.6-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ansible-test-2.21-0:2.21.6-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.s390x"
        },
        "product_reference": "ansible-test-2.21-0:2.21.6-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ansible-test-2.21-0:2.21.6-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.x86_64"
        },
        "product_reference": "ansible-test-2.21-0:2.21.6-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-5115",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-5115"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An absolute path traversal attack exists in the Ansible automation platform. This flaw allows an attacker to craft a malicious Ansible role and make the victim execute the role. A symlink can be used to overwrite a file outside of the extraction path.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.aarch64",
          "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.ppc64le",
          "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.s390x",
          "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.x86_64",
          "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.aarch64",
          "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.ppc64le",
          "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.s390x",
          "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-5115",
          "url": "https://www.suse.com/security/cve/CVE-2023-5115"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1215606 for CVE-2023-5115",
          "url": "https://bugzilla.suse.com/1215606"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.aarch64",
            "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.ppc64le",
            "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.s390x",
            "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.x86_64",
            "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.aarch64",
            "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.ppc64le",
            "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.s390x",
            "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.aarch64",
            "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.ppc64le",
            "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.s390x",
            "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.x86_64",
            "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.aarch64",
            "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.ppc64le",
            "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.s390x",
            "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-11-06T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2023-5115"
    },
    {
      "cve": "CVE-2023-5764",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-5764"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A template injection flaw was found in Ansible where a user\u0027s controller internal templating operations may remove the unsafe designation from template data. This issue could allow an attacker to use a specially crafted file to introduce templating injection when supplying templating data.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.aarch64",
          "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.ppc64le",
          "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.s390x",
          "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.x86_64",
          "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.aarch64",
          "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.ppc64le",
          "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.s390x",
          "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-5764",
          "url": "https://www.suse.com/security/cve/CVE-2023-5764"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1216854 for CVE-2023-5764",
          "url": "https://bugzilla.suse.com/1216854"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.aarch64",
            "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.ppc64le",
            "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.s390x",
            "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.x86_64",
            "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.aarch64",
            "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.ppc64le",
            "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.s390x",
            "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.6,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.aarch64",
            "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.ppc64le",
            "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.s390x",
            "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.x86_64",
            "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.aarch64",
            "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.ppc64le",
            "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.s390x",
            "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-11-06T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2023-5764"
    },
    {
      "cve": "CVE-2024-0690",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-0690"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An information disclosure flaw was found in ansible-core due to a failure to respect the ANSIBLE_NO_LOG configuration in some scenarios. Information is still included in the output in certain tasks, such as loop items. Depending on the task, this issue may include sensitive information, such as decrypted secret values.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.aarch64",
          "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.ppc64le",
          "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.s390x",
          "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.x86_64",
          "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.aarch64",
          "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.ppc64le",
          "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.s390x",
          "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-0690",
          "url": "https://www.suse.com/security/cve/CVE-2024-0690"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1219002 for CVE-2024-0690",
          "url": "https://bugzilla.suse.com/1219002"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.aarch64",
            "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.ppc64le",
            "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.s390x",
            "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.x86_64",
            "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.aarch64",
            "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.ppc64le",
            "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.s390x",
            "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.aarch64",
            "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.ppc64le",
            "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.s390x",
            "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.x86_64",
            "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.aarch64",
            "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.ppc64le",
            "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.s390x",
            "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-11-06T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-0690"
    },
    {
      "cve": "CVE-2024-11079",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-11079"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw was found in Ansible-Core. This vulnerability allows attackers to bypass unsafe content protections using the hostvars object to reference and execute templated content. This issue can lead to arbitrary code execution if remote data or module outputs are improperly templated within playbooks.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.aarch64",
          "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.ppc64le",
          "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.s390x",
          "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.x86_64",
          "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.aarch64",
          "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.ppc64le",
          "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.s390x",
          "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-11079",
          "url": "https://www.suse.com/security/cve/CVE-2024-11079"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1233276 for CVE-2024-11079",
          "url": "https://bugzilla.suse.com/1233276"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.aarch64",
            "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.ppc64le",
            "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.s390x",
            "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.x86_64",
            "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.aarch64",
            "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.ppc64le",
            "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.s390x",
            "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.aarch64",
            "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.ppc64le",
            "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.s390x",
            "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.x86_64",
            "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.aarch64",
            "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.ppc64le",
            "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.s390x",
            "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-11-06T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-11079"
    },
    {
      "cve": "CVE-2024-8775",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-8775"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw was found in Ansible, where sensitive information stored in Ansible Vault files can be exposed in plaintext during the execution of a playbook. This occurs when using tasks such as include_vars to load vaulted variables without setting the no_log: true parameter, resulting in sensitive data being printed in the playbook output or logs. This can lead to the unintentional disclosure of secrets like passwords or API keys, compromising security and potentially allowing unauthorized access or actions.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.aarch64",
          "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.ppc64le",
          "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.s390x",
          "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.x86_64",
          "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.aarch64",
          "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.ppc64le",
          "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.s390x",
          "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-8775",
          "url": "https://www.suse.com/security/cve/CVE-2024-8775"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1230601 for CVE-2024-8775",
          "url": "https://bugzilla.suse.com/1230601"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.aarch64",
            "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.ppc64le",
            "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.s390x",
            "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.x86_64",
            "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.aarch64",
            "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.ppc64le",
            "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.s390x",
            "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.aarch64",
            "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.ppc64le",
            "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.s390x",
            "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.x86_64",
            "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.aarch64",
            "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.ppc64le",
            "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.s390x",
            "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-11-06T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-8775"
    },
    {
      "cve": "CVE-2024-9902",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-9902"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw was found in Ansible. The ansible-core `user` module can allow an unprivileged user to silently create or replace the contents of any file on any system path and take ownership of it when a privileged user executes the `user` module against the unprivileged user\u0027s home directory. If the unprivileged user has traversal permissions on the directory containing the exploited target file, they retain full control over the contents of the file as its owner.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.aarch64",
          "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.ppc64le",
          "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.s390x",
          "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.x86_64",
          "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.aarch64",
          "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.ppc64le",
          "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.s390x",
          "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-9902",
          "url": "https://www.suse.com/security/cve/CVE-2024-9902"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1233000 for CVE-2024-9902",
          "url": "https://bugzilla.suse.com/1233000"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1289627 for CVE-2024-9902",
          "url": "https://bugzilla.suse.com/1289627"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.aarch64",
            "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.ppc64le",
            "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.s390x",
            "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.x86_64",
            "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.aarch64",
            "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.ppc64le",
            "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.s390x",
            "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.aarch64",
            "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.ppc64le",
            "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.s390x",
            "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.x86_64",
            "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.aarch64",
            "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.ppc64le",
            "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.s390x",
            "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-11-06T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-9902"
    },
    {
      "cve": "CVE-2026-105929",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-105929"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "unknown",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.aarch64",
          "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.ppc64le",
          "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.s390x",
          "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.x86_64",
          "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.aarch64",
          "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.ppc64le",
          "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.s390x",
          "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-105929",
          "url": "https://www.suse.com/security/cve/CVE-2026-105929"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1289573 for CVE-2026-105929",
          "url": "https://bugzilla.suse.com/1289573"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.aarch64",
            "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.ppc64le",
            "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.s390x",
            "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.x86_64",
            "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.aarch64",
            "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.ppc64le",
            "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.s390x",
            "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-11-06T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-105929"
    },
    {
      "cve": "CVE-2026-11332",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-11332"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications from a role\u0027s meta/requirements.yml file. Due to improper neutralization of argument delimiters, a malicious role author can inject arbitrary git configuration flags through the src field. This allows arbitrary code execution on the machine of a user who installs the role via ansible-galaxy role install.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.aarch64",
          "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.ppc64le",
          "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.s390x",
          "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.x86_64",
          "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.aarch64",
          "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.ppc64le",
          "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.s390x",
          "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-11332",
          "url": "https://www.suse.com/security/cve/CVE-2026-11332"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1267822 for CVE-2026-11332",
          "url": "https://bugzilla.suse.com/1267822"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1272369 for CVE-2026-11332",
          "url": "https://bugzilla.suse.com/1272369"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.aarch64",
            "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.ppc64le",
            "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.s390x",
            "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.x86_64",
            "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.aarch64",
            "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.ppc64le",
            "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.s390x",
            "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.aarch64",
            "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.ppc64le",
            "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.s390x",
            "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.x86_64",
            "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.aarch64",
            "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.ppc64le",
            "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.s390x",
            "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-11-06T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-11332"
    },
    {
      "cve": "CVE-2026-16493",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-16493"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw was found in ansible-core. The _extract_collection_from_git() function in ansible-core\u0027s concrete_artifact_manager.py constructs git clone commands without a \u0027--\u0027 (end-of-options) separator before user-supplied URLs when installing collections from git sources. An attacker who provides a crafted collection source URI containing git argument injection payloads can achieve arbitrary command execution when a user runs \u0027ansible-galaxy collection install\u0027 with the malicious source. This is an incomplete fix for CVE-2026-11332, which hardened the role install path but missed the equivalent collection install code path.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.aarch64",
          "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.ppc64le",
          "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.s390x",
          "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.x86_64",
          "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.aarch64",
          "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.ppc64le",
          "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.s390x",
          "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-16493",
          "url": "https://www.suse.com/security/cve/CVE-2026-16493"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1272369 for CVE-2026-16493",
          "url": "https://bugzilla.suse.com/1272369"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.aarch64",
            "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.ppc64le",
            "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.s390x",
            "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.x86_64",
            "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.aarch64",
            "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.ppc64le",
            "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.s390x",
            "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.aarch64",
            "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.ppc64le",
            "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.s390x",
            "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.x86_64",
            "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.aarch64",
            "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.ppc64le",
            "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.s390x",
            "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-11-06T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-16493"
    },
    {
      "cve": "CVE-2026-84503",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-84503"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "unknown",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.aarch64",
          "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.ppc64le",
          "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.s390x",
          "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.x86_64",
          "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.aarch64",
          "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.ppc64le",
          "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.s390x",
          "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-84503",
          "url": "https://www.suse.com/security/cve/CVE-2026-84503"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1289577 for CVE-2026-84503",
          "url": "https://bugzilla.suse.com/1289577"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.aarch64",
            "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.ppc64le",
            "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.s390x",
            "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.x86_64",
            "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.aarch64",
            "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.ppc64le",
            "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.s390x",
            "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-11-06T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-84503"
    },
    {
      "cve": "CVE-2026-89091",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-89091"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw was found in ansible-core. When installing a collection with\n`ansible-galaxy collection install`, the archive extractor validates member\npaths using lexical path normalisation (os.path.abspath) instead of resolving\nsymbolic links (os.path.realpath), and it performs no containment check on\nsymlink-typed directory members before creating them. A crafted collection\ntarball can chain symlink directory entries so that a subsequent file member is\nwritten outside the intended destination directory. This allows an attacker who\ncan get a victim to install a malicious collection to overwrite arbitrary files\nwith the privileges of the user running ansible-galaxy, leading to code\nexecution on the control node. This is a bypass of the fix for CVE-2020-10691.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.aarch64",
          "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.ppc64le",
          "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.s390x",
          "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.x86_64",
          "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.aarch64",
          "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.ppc64le",
          "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.s390x",
          "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-89091",
          "url": "https://www.suse.com/security/cve/CVE-2026-89091"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1284847 for CVE-2026-89091",
          "url": "https://bugzilla.suse.com/1284847"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.aarch64",
            "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.ppc64le",
            "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.s390x",
            "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.x86_64",
            "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.aarch64",
            "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.ppc64le",
            "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.s390x",
            "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.aarch64",
            "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.ppc64le",
            "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.s390x",
            "openSUSE Tumbleweed:ansible-core-2.21-0:2.21.6-1.1.x86_64",
            "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.aarch64",
            "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.ppc64le",
            "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.s390x",
            "openSUSE Tumbleweed:ansible-test-2.21-0:2.21.6-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-11-06T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-89091"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON
How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.