Ansible/Security

Security concerns when using Ansible.

ansible.cfg and world writable directories

If Ansible were to load :file:ansible.cfg from a world-writable current working directory, it would create a serious security risk. Another user could place their own config file there, designed to make Ansible run malicious code both locally and remotely, possibly with elevated privileges. For this reason, Ansible will not automatically load a config file from the current working directory if the directory is world-writable.

If you depend on using Ansible with a config file in the current working directory, the best way to avoid this problem is to restrict access to your Ansible directories to particular user(s) and/or group(s).

- https://docs.ansible.com/ansible/latest/reference_appendices/config.html#ansible-configuration-settings