CVE-2021-4041

A flaw was found in ansible-runner. An improper escaping of the shell command, while calling the ansible_runner.interface.run_command, can lead to parameters getting executed as host's shell command. A developer could unintentionally write code that gets executed in the host rather than the virtual environment.

• CWE-20
• CWE-116

• https://access.redhat.com/security/cve/CVE-2021-4041Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2028074Issue Tracking, Patch, Vendor Advisory
• https://github.com/ansible/ansible-runner/commit/3533f265f4349a3f2a0283158cd01b59a6bbc7bdPatch, Third Party Advisory
• https://access.redhat.com/security/cve/CVE-2021-4041Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2028074Issue Tracking, Patch, Vendor Advisory
• https://github.com/ansible/ansible-runner/commit/3533f265f4349a3f2a0283158cd01b59a6bbc7bdPatch, Third Party Advisory

Published

Aug 24, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-40404An authentication bypass vulnerability exists in the cgiserv…6.5
• CVE-2021-40405A denial of service vulnerability exists in the cgiserver.cg…6.5
• CVE-2021-40406A denial of service vulnerability exists in the cgiserver.cg…7.5
• CVE-2021-40407An OS command injection vulnerability exists in the device n…7.2
• CVE-2021-40408An OS command injection vulnerability exists in the device n…9.8
• CVE-2021-40409An OS command injection vulnerability exists in the device n…9.8
• CVE-2021-40410An OS command injection vulnerability exists in the device n…7.2
• CVE-2021-40411An OS command injection vulnerability exists in the device n…7.2
• CVE-2021-40412An OScommand injection vulnerability exists in the device ne…7.2
• CVE-2021-40413An incorrect default permission vulnerability exists in the …7.1
• CVE-2021-40414An incorrect default permission vulnerability exists in the …7.1
• CVE-2021-40415An incorrect default permission vulnerability exists in the …6.5