Read the docs
TI-2021-02620 Aliases CVE-2021-3681GHSA-wh68-r6p4-7cv3

Insufficiently protected credentials in ansible

Priority LOW 24CWE-522Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-522.

Summary

A flaw was found in Ansible Galaxy Collections. When collections are built manually, any files in the repository directory that are not explicitly excluded via the ``build_ignore`` list in "galaxy.yml" include files in the ``.tar.gz`` file. This contains sensitive info, such as the user's Ansible Galaxy API key and any secrets in ``ansible`` or ``ansible-playbook`` verbose output without the``no_log`` redaction. Currently, there is no way to deprecate a Collection Or delete a Collection Version. Once published, anyone who downloads or installs the collection can view the secrets.

Why it matters now

EPSS 0.00247 16th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—ansibleansible 3.3.0—No fix listedCNA
  • ansible Vendor— Affected ansible 3.3.0 Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:redhat:ansible_automation_platform:1.2:*:*:*:*:*:*:*1.2VulnerableRed Hat
cpe:2.3:a:redhat:ansible_galaxy:3.3.0:*:*:*:*:*:*:*3.3.0VulnerableRed Hat
  • cpe:2.3:a:redhat:ansible_automation_platform:1.2:*:*:*:*:*:*:* Versions 1.2 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:ansible_galaxy:3.3.0:*:*:*:*:*:*:* Versions 3.3.0 Vulnerable ·Red Hat

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Ansible Automation Platform 1.2AffectedNo fix yet

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-3681
  2. 2026-10-03 Alias added: GHSA-wh68-r6p4-7cv3

References

Advisory 2

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2026-35991 Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks KEVCVSS 3.1MEDIUM 6.5
  • TI-2026-34281 JavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injection CVSS 3.1HIGH 7.5
  • TI-2026-28834 jq: Out-of-Bounds Read in jv_parse_sized() Error Formatting for Non-NUL-Terminated Counted Buffers CVSS 4.0MEDIUM 6.9
  • TI-2026-32429 Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge CVSS 3.1HIGH 7.7
  • TI-2023-27712 Python-cryptography: bleichenbacher timing oracle attack against rsa decryption - incomplete fix for cve-2020-25659 CVSS 3.1HIGH 7.5
See all 28 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences