Information disclosure through error messages in ansible
Priority LOW 25CWE-209Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Partial Red Hat: 9 fixed, 4 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-209.
Summary
A flaw was found in Ansible Engine's ansible-connection module, where sensitive information such as the Ansible user credentials is disclosed by default in the traceback error message. The highest threat from this vulnerability is to confidentiality.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0039 33rd percentileScored 2026-11-07
Fix Partial ansible (PyPI): 2.9.27Red Hat: 5 advisoriesRed Hat: 9 fixed, 4 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | ansible | Fixed in Ansible Engine v2.9.27 | — | No fix listed | CNA |
| — | ansible (PyPI) | before 2.9.27 | 2.9.27 | Patch available | GHSA-4r65-35qq-ch8j |
- ansible Vendor— Affected Fixed in Ansible Engine v2.9.27 Fixed in — No fix listed CNA
- ansible (PyPI) Vendor— Affected before 2.9.27 Fixed in 2.9.27 Patch available GHSA-4r65-35qq-ch8j
CPE configurations NVD · 10
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:redhat:ansible_automation_platform_early_access:2.0:*:*:*:*:*:*:* | 2.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:ansible_engine:*:*:*:*:*:*:*:* | before 2.9.27 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:openstack:1:*:*:*:*:*:*:* | 1 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:openstack:16.1:*:*:*:*:*:*:* | 16.1 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:virtualization:4.0:*:*:*:*:*:*:* | 4.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:virtualization_for_ibm_power_little_endian:4.0:*:*:*:*:*:*:* | 4.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:virtualization_host:4.0:*:*:*:*:*:*:* | 4.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:virtualization_manager:4.4:*:*:*:*:*:*:* | 4.4 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Red Hat |
- cpe:2.3:a:redhat:ansible_automation_platform_early_access:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:ansible_engine:*:*:*:*:*:*:*:* Versions before 2.9.27 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:openstack:1:*:*:*:*:*:*:* Versions 1 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:openstack:16.1:*:*:*:*:*:*:* Versions 16.1 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:virtualization:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:virtualization_for_ibm_power_little_endian:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:virtualization_host:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:virtualization_manager:4.4:*:*:*:*:*:*:* Versions 4.4 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
Remediation
- Fix · GHSA-4r65-35qq-ch8j ansible (PyPI) Fixed in 2.9.27 Advisory →
Red Hat 5 advisories
- RHSA-2021:4750 Released 2021-11-19 · Red Hat rating ImportantRed Hat Virtualization Host security and bug fix update [ovirt-4.4.9] 0-day
- Red Hat Virtualization 4 Hypervisor for RHEL 8 redhat-virtualization-host-4.4.9-202111172338_8.5, redhat-virtualization-host-image-update-4.4.9-202111172338_8.5
- RHSA-2021:4703 Released 2021-11-16 · Red Hat rating ImportantRHV Engine and Host Common Packages security update [ovirt-4.4.9]
- RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4 ansible-2.9.27-1.el8ae, ovirt-ansible-collection-1.6.5-1.el8ev
- Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts ansible-2.9.27-1.el8ae, ovirt-ansible-collection-1.6.5-1.el8ev
- Red Hat Virtualization 4 Tools for Red Hat Enterprise Linux 8 ovirt-ansible-collection-1.6.5-1.el8ev
- RHSA-2021:3874 Released 2021-10-14 · Red Hat rating ImportantRed Hat Ansible Automation Platform 2.0.1 Security and Bug fix Release
- Red Hat Ansible Automation Platform 2.0 for RHEL 8 ansible-2.9.27-1.el8ap, ansible-core-2.11.6-1.el8ap, ansible-test-2.11.6-1.el8ap
Show 2 more Red Hat advisories
- RHSA-2021:3872 Released 2021-10-14 · Red Hat rating ImportantAnsible security and bug fix update (2.9.27)
- Red Hat Ansible Engine 2 for RHEL 7 ansible-2.9.27-1.el7ae, ansible-test-2.9.27-1.el7ae
- Red Hat Ansible Engine 2 for RHEL 8 ansible-2.9.27-1.el8ae, ansible-test-2.9.27-1.el8ae
- RHSA-2021:3871 Released 2021-10-14 · Red Hat rating ImportantAnsible security and bug fix update (2.9.27)
- Red Hat Ansible Engine 2.9 for RHEL 7 Server ansible-2.9.27-1.el7ae, ansible-test-2.9.27-1.el7ae
- Red Hat Ansible Engine 2.9 for RHEL 8 ansible-2.9.27-1.el8ae, ansible-test-2.9.27-1.el8ae
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Ansible Automation Platform 1.2 | Affected | No fix yet |
| Red Hat Ceph Storage 2 | Affected | No fix planned: Will not fix |
| Red Hat Ceph Storage 3 | Affected | No fix planned: Will not fix |
| Red Hat Storage 3 | Affected | No fix planned: Will not fix |
| RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4 | Fixed | RHSA-2021:4703 |
| Red Hat Ansible Automation Platform 2.0 for RHEL 8 | Fixed | RHSA-2021:3874 |
| Red Hat Ansible Engine 2 for RHEL 7 | Fixed | RHSA-2021:3872 |
| Red Hat Ansible Engine 2 for RHEL 8 | Fixed | RHSA-2021:3872 |
| Red Hat Ansible Engine 2.9 for RHEL 7 Server | Fixed | RHSA-2021:3871 |
| Red Hat Ansible Engine 2.9 for RHEL 8 | Fixed | RHSA-2021:3871 |
| Red Hat Virtualization 4 Hypervisor for RHEL 8 | Fixed | RHSA-2021:4750 |
| Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts | Fixed | RHSA-2021:4703 |
| Red Hat Virtualization 4 Tools for Red Hat Enterprise Linux 8 | Fixed | RHSA-2021:4703 |
Not affected: 3 products
- RHEL 8-based RHEV-H for RHEV 4 (build requirements)
- RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4
- Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts
Timeline
- 2026-10-02 Threatist record created from CVE-2021-3620
- 2026-10-03 Alias added: GHSA-4r65-35qq-ch8j
References
Patch 2
Advisory 3
Other 9
- https://lists.debian.org/debian-lts-announce/2023/12/msg00018.html
- https://access.redhat.com/errata/RHSA-2021:3871
- https://access.redhat.com/errata/RHSA-2021:3872
- https://access.redhat.com/errata/RHSA-2021:3874
- https://access.redhat.com/errata/RHSA-2021:4703
- https://access.redhat.com/errata/RHSA-2021:4750
- https://access.redhat.com/security/cve/CVE-2021-3620
- https://github.com/ansible/ansible
- https://github.com/pypa/advisory-database/tree/main/vulns/ansible/PYSEC-2022-164.yaml
More Red Hat Ansible Automation Platform Early Access vulnerabilities
- TI-2021-02990 A flaw was found in ansible-tower where the default installation is vulnerable to job… CVSS 3.1HIGH 8.8
Sources
- CVE-2021-3620 · CVE Program
- CVE-2021-3620 · NVD
- FIRST EPSS
- GHSA-4r65-35qq-ch8j · GitHub Advisory Database · CC BY 4.0
- CVE-2021-3620 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences