A flaw was found in the memcached cache plugin of the community.general Ansible collection. (CVE-2026-87874)

The memcached cache plugin in the community.general Ansible collection does not perform explicit serialization and depends on python-memcached, which uses Python's pickle mechanism to serialize and deserialize cache values. Since memcached is unauthenticated and cache keys are predictable, an attacker who can access a network-exposed or shared memcached instance can write a crafted pickle payload. When the Ansible controller reads the poisoned fact cache, the malicious payload is deserialized and executed, resulting in remote code execution on the controller. This vulnerability is tracked as CVE-2026-87874 with a CVSS 3.1 score of 8.1 (high impact but medium severity assigned).

Successful exploitation allows an unauthenticated attacker with network access to a memcached instance used by the Ansible controller to execute arbitrary code remotely on the controller. This compromises confidentiality, integrity, and availability of the controller system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to memcached instances used by Ansible controllers to trusted hosts only to prevent unauthorized access. Avoid exposing memcached instances to untrusted networks.