CVE-2021-20253

MEDIUM

Ansible-Tower - Privilege Escalation

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2021-20253. PoCs published by mbadanoiu.

AI-analyzed exploit summary The repository lacks functional exploit code and instead redirects to an external PDF for details, which is a common tactic in suspicious repos. No technical depth or actual PoC is provided in the README.

Description

A flaw was found in ansible-tower. The default installation is vulnerable to Job Isolation escape allowing an attacker to elevate the privilege from a low privileged user to the awx user from outside the isolated environment. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Exploits (1)

nomisec SUSPICIOUS 1 stars
by mbadanoiu · poc
https://github.com/mbadanoiu/CVE-2021-20253

The repository lacks functional exploit code and instead redirects to an external PDF for details, which is a common tactic in suspicious repos. No technical depth or actual PoC is provided in the README.

Classification
Suspicious 90%
Attack Type
Lpe
Complexity
Theoretical
Reliability
Theoretical
Target: Ansible Tower (version not specified)
Auth required
Prerequisites: Low-privileged OS access · Ability to execute commands in Ansible Tower's isolation environment
devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (1)

Core 1
Core References
Issue Tracking, Vendor Advisory x_refsource_misc
https://bugzilla.redhat.com/show_bug.cgi?id=1928847

Scores

CVSS v3 6.7
EPSS 0.0041
EPSS Percentile 32.6%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-552
Status published
Products (1)
redhat/ansible_tower < 3.6.7
Published Mar 09, 2021
Tracked Since Feb 18, 2026