CVE-2026-87874

Pickle‑based RCE via unsanitized memcached fact cache in Ansible plugin.

• CVSS 8.1
• 502
• Design Defects
• Remote

A flaw was found in the memcached cache plugin of the community.general Ansible collection. Although its documentation states that records are stored in JSON format, the plugin performs no explicit serialization and relies on python-memcached, which pickles values on write and unpickles them on read. Because memcached is unauthenticated and cache keys are predictable, an attacker able to reach a network-exposed or shared memcached instance can write a crafted pickle payload that is deserialized and executed on the Ansible controller when the poisoned fact cache is next read, leading to remote code execution.

CVE

CVE-2026-87874

CWE

502

CVSS base score

8.1

Published

2026-09-09

OWASP

A08 Software and Data Integrity Failures

Orthogonal defect classification

Timing/Serialization

Code defect classification

Serialization Issues

Category

Design Defects

Subcategory

Poorly Designed Access Controls

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Affected component

python-memcached

Solution

Upgrade the community.general collection to version 8.5.0 (or later), which disables pickle usage in the memcached fact cache and fixes the RCE vulnerability.

import memcache
import json

def cache_fact(key: str, data, client: memcache.Client):
    # VULNERABLE: storing raw object causes pickle deserialization on read
    client.set(key, data)

def retrieve_fact(key: str, client: memcache.Client):
    raw = client.get(key)
    return raw

import memcache
import json

def cache_fact(key: str, data, client: memcache.Client):
    # FIX: serialize to JSON to avoid pickle execution
    json_data = json.dumps(data)
    client.set(key, json_data)

def retrieve_fact(key: str, client: memcache.Client):
    raw = client.get(key)
    return json.loads(raw) if raw is not None else None

__VAITP_MODEL_REFUSED__

@misc{vaitp:cve202687874,
  title        = {{Pickle‑based RCE via unsanitized memcached fact cache in Ansible plugin.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2026},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2026-87874},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2026-87874/}}
}