A flaw was found in the memcached cache plugin of the community.general Ansible
collection. Although its documentation states that records are stored in JSON
format, the plugin performs no explicit serialization and relies on
python-memcached, which pickles values on write and unpickles them on read.
Because memcached is unauthenticated and cache keys are predictable, an attacker
able to reach a network-exposed or shared memcached instance can write a crafted
pickle payload that is deserialized and executed on the Ansible controller when
the poisoned fact cache is next read, leading to remote code execution.
Bind memcached to localhost only (the plugin default, 127.0.0.1:11211) and
never expose an unauthenticated memcached across a trust boundary; isolate the
cache to the controller. Prefer the redis cache plugin (explicit JSON) or the
jsonfile/yaml cache plugins where a shared/remote fact cache is required. Treat
any host with write access to the fact-cache memcached as trusted to run code
on the controller.