CVE-2026-31431 — Ansible playbooks to check and mitigate CVE-2026-31431 on Linux hosts, with scripts for local, remote, and containerized environments, including CI/CD integration. | Kitploit

CVE-2026-31431 (Copy Fail) Checker

Checks whether a Linux host is vulnerable to CVE-2026-31431 and applies mitigation.

Files

check_cve_2026_31431.yml - Ansible playbook to verify and patch
revert_cve_2026_31431.yml - Ansible playbook to undo mitigation
run_check.sh - Script to run verification locally or remotely
run_revert.sh - Script to undo changes locally or remotely

Execution examples

1. Check vulnerability (run_check.sh)

./run_check.sh
# Select 'l' for local

Or directly:

ansible-playbook -i "localhost," -c local --ask-become-pass check_cve_2026_31431.yml -v

docker run -it --privileged ubuntu:22.04 /bin/bash
# Inside the container:
apt update && apt install -y ansible python3
# Copy the playbook to the container or use curl/wget
ansible-playbook -i "localhost," -c local check_cve_2026_31431.yml -v

name: Check CVE-2026-31431

on:
  push:
    branches: [ main ]
  pull_request:

jobs:
  check-vulnerability:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3

      - name: Build test image
        run: docker build -t test-image .

      - name: Check for CVE-2026-31431 in container
        run: |
          docker run --rm \
            -v ${{ github.workspace }}/check_cve_2026_31431.yml:/check.yml \
            test-image \
            /bin/bash -c "apt update && apt install -y ansible python3 && \
            echo 'no' | ansible-playbook -i 'localhost,' -c local /check.yml -v"

      - name: Fail if vulnerable
        run: |
          # The playbook must return != 0 if vulnerable
          # Or parse the output looking for "VULNERABLE"

stages:
  - build
  - security

build_image:
  stage: build
  script:
    - docker build -t $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA .

check_cve:
  stage: security
  script:
    - docker run --rm -v $(pwd)/check_cve_2026_31431.yml:/check.yml $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA
      /bin/bash -c "apt-get update && apt-get install -y ansible python3 && 
      ansible-playbook -i 'localhost,' -c local /check.yml -v | grep -q 'SAFE' || exit 1"
  rules:
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'

FROM ubuntu:22.04

RUN apt-get update && apt-get install -y ansible python3 wget

# Copy and run check during build
COPY check_cve_2026_31431.yml /tmp/
RUN echo "no" | ansible-playbook -i "localhost," -c local /tmp/check_cve_2026_31431.yml -v | \
    grep -q "SAFE" || (echo "VULNERABLE - Fix before building" && exit 1)

# Rest of your image...

CVE-2026-31431

Most Popular

2. Revert changes (run_revert.sh)

2. Remote

3. Revert changes (undo mitigation)

4. Inside a Docker container

5. CI/CD Pipeline for Docker images

What run_check.sh does

What run_revert.sh does

What the playbook does

Expected result