CVE-2026-87874: Ansible memcached Plugin RCE Vulnerability

CVE-2026-87874 Overview

CVE-2026-87874 is an insecure deserialization vulnerability in the memcached cache plugin of the community.general Ansible collection. The plugin's documentation states records are stored as JSON, but no explicit serialization occurs. Instead, the plugin relies on python-memcached, which pickles values on write and unpickles them on read. Because memcached instances are unauthenticated and Ansible fact-cache keys are predictable, an attacker with network access to a shared memcached instance can inject a crafted pickle payload. When the poisoned fact cache is next read, the payload is deserialized and executed on the Ansible controller, resulting in remote code execution [CWE-502].

Critical Impact
Attackers with network access to a shared memcached instance can execute arbitrary code on the Ansible controller by poisoning the fact cache with a malicious pickle payload.

Affected Products

community.general Ansible collection — memcached cache plugin
python-memcached library (as a transitive dependency exhibiting pickle-based serialization)
Ansible controllers configured to use the memcached fact cache backend

Discovery Timeline

2026-09-09 - CVE-2026-87874 published to the National Vulnerability Database (NVD)
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87874

Vulnerability Analysis

The community.general memcached cache plugin advertises JSON as its storage format. In practice, it never invokes an explicit serializer. Instead, values pass directly to python-memcached, which uses Python's pickle module to encode and decode arbitrary objects. Pickle deserialization executes constructor and reducer methods embedded in the byte stream, giving any writable data source in memcached a direct path to code execution on the reader.

Ansible uses this cache to persist gathered facts between playbook runs. Fact cache keys follow deterministic naming patterns tied to inventory hostnames, so an attacker does not need to guess opaque identifiers. The next Ansible run that reads the poisoned key deserializes the attacker-supplied object and executes the embedded payload with the privileges of the Ansible controller process.

Root Cause

The root cause is unsafe deserialization of untrusted data [CWE-502]. The plugin trusts values returned from memcached and hands them to pickle.loads through the python-memcached client without integrity checks, authentication, or a safe serialization format such as JSON.

Attack Vector

Exploitation requires network reach to a memcached instance used as an Ansible fact cache. Memcached exposes no authentication by default. An attacker connects to port 11211, writes a pickle payload under a predictable fact-cache key such as ansible_facts<hostname>, and waits for the Ansible controller to read the key. On read, deserialization triggers arbitrary code execution on the controller host. Attack complexity is elevated because the attacker must reach the cache and time the poisoning against a controller read, but no user interaction or credentials are required.

Refer to the Red Hat CVE-2026-87874 advisory and Red Hat Bug Report #2530995 for vendor technical details.

Detection Methods for CVE-2026-87874

Indicators of Compromise

Unexpected outbound network connections, shell processes, or child processes spawned by the Ansible controller process shortly after a playbook run.
Memcached entries under ansible_facts* keys containing binary pickle opcodes such as \\x80\\x04 or the c__builtin__\nreduce sequence.
Writes to memcached from source addresses that do not correspond to authorized Ansible controllers.
New cron jobs, SSH keys, or persistence artifacts appearing on the controller host after fact-cache reads.

Detection Strategies

Monitor Ansible controller hosts for anomalous process lineage where ansible-playbook or python spawns interactive shells, curl, wget, or compilers.
Inspect memcached traffic for set commands targeting Ansible fact-cache namespaces from unexpected clients.
Enable audit logging on the controller and correlate playbook execution times with subsequent process creation and outbound connection events.

Monitoring Recommendations

Alert on any memcached instance reachable from untrusted network segments, particularly on the default port 11211.
Track file integrity on the Ansible controller for changes to ~/.ssh/authorized_keys, /etc/cron.*, and systemd unit directories following playbook runs.
Forward controller process, network, and file telemetry to a centralized data lake for cross-source correlation and retrospective hunts.

How to Mitigate CVE-2026-87874

Immediate Actions Required

Restrict memcached network exposure to loopback or a tightly firewalled management segment reachable only by the Ansible controller.
Switch the Ansible fact cache backend to jsonfile or another plugin that does not rely on pickle-based serialization until a fixed release is deployed.
Flush existing memcached contents to remove any previously poisoned fact-cache entries.
Audit Ansible controller hosts for signs of prior exploitation, including unexpected processes, persistence artifacts, and outbound connections.

Patch Information

Refer to the Red Hat CVE-2026-87874 advisory and Red Hat Bug Report #2530995 for fixed versions of the community.general collection and downstream package updates. Apply vendor updates as soon as they are available and rotate any secrets that were accessible to the Ansible controller.

Workarounds

Bind memcached to 127.0.0.1 and require SASL authentication if a network-accessible cache is unavoidable.
Replace the memcached fact cache with ansible.builtin.jsonfile, ansible.builtin.redis with a hardened configuration, or an equivalent backend that does not deserialize untrusted data.
Segment the Ansible controller onto a dedicated management network with strict egress filtering to limit post-exploitation impact.

bash

# Example: switch Ansible fact cache away from memcached in ansible.cfg
[defaults]
fact_caching = jsonfile
fact_caching_connection = /var/lib/ansible/facts.d
fact_caching_timeout = 7200

# Restrict memcached to localhost only (memcached.conf / systemd override)
-l 127.0.0.1
-p 11211