The controller machine for Ansible requires SSH and Python to be installed and configured. Ansible has a very low attack surface. In January 2017, multiple security issues were found by a company called Computest.
Note
Read more about what they found at https://www.computest.nl/advisories/CT-2017-0109_Ansible.txt. This vulnerability was dubbed owning the farm, since compromising the controller would imply that all the nodes could potentially be compromised.
The controller machine should be a hardened server and treated with all the seriousness that it deserves. In the vulnerability that was disclosed, if a node gets compromised attackers could leverage that to attack and gain access to the controller. Once they have access, the could extend their control over all the other nodes being managed by the controller.
Since the attack surface is already very limited, the best we can do is ensure that the server stays secure and hardened.
Two projects worth following...