CVE-2026-87874

The memcached cache plugin of the community.general Ansible collection documents that cache records are stored as JSON, but it performs no explicit serialization and instead relies on the python-memcached client, which pickles values on write and unpickles them on read. Because memcached is unauthenticated and the plugin's cache keys are predictable, an attacker who can reach a network-exposed or shared memcached instance used for Ansible fact caching can overwrite a cache entry with a crafted pickle payload. When the Ansible controller next reads the poisoned fact cache, the payload is deserialized and executed, yielding remote code execution on the controller with the privileges of the Ansible process. Affected users are those running the community.general collection with the memcached fact cache plugin configured, especially where the memcached instance is reachable from untrusted networks or shared with other tenants. No public proof-of-concept or in-the-wild exploitation is known, and the flaw is not listed in CISA's KEV catalog.

What to do: Identify whether any Ansible controllers use the memcached fact cache plugin and, until a fixed community.general release that restores explicit (JSON) serialization is published, either switch to another fact cache plugin (e.g., the JSON file cache) or restrict memcached to a trusted network segment with no untrusted write access. Check installed collection versions against the Red Hat/Ansible advisory and upgrade to the fixed release when available. Since memcached itself is unauthenticated, audit the cache used by Ansible for unexpected or foreign keys and ensure shared tenants cannot write to it.