The vulnerability CVE-2024-11079 in Ansible-Core involves improper input validation that enables attackers to bypass unsafe content protections via the hostvars object. This allows referencing and execution of templated content that should otherwise be restricted. If remote data or module outputs are improperly templated within playbooks, this can lead to arbitrary code execution. Red Hat's advisories confirm the issue and provide updated versions of ansible-core (2.15.13, 2.16.14, 2.17.7, 2.18.1) in their Execution Environments to mitigate the vulnerability.

Successful exploitation of this vulnerability can lead to arbitrary code execution due to unsafe templating bypass. The CVSS 3.1 base score is 5.5 (medium severity) with network attack vector, high attack complexity, low privileges required, and requiring user interaction. Confidentiality, integrity, and availability impacts are all low but the scope is changed, indicating potential impact beyond the vulnerable component.

Red Hat has released official fixes for this vulnerability in ansible-core versions 2.15.13, 2.16.14, 2.17.7, and 2.18.1 as part of the Ansible Automation Platform Execution Environments updates. Users should apply these updates to remediate the issue. The vendor advisory is the authoritative source for patch status and remediation guidance.