Sensitive information in log files in ansible-collections Ansible Community General…
Priority MEDIUM 58CWE-532Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Partial Red Hat: 6 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-532.
Summary
A flaw was found in ansible-collection-community-general. This vulnerability allows for information exposure (IE) of sensitive credentials, specifically plaintext passwords, via verbose output when running Ansible with debug modes. Attackers with access to logs could retrieve these secrets and potentially compromise Keycloak accounts or administrative access.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00199 9th percentileScored 2026-11-07
Fix Partial Ansible Community General Collection (ansible-collections): 9.5.13, 10.7.6, 11.4.1 +1ansible (PyPI): 12.2.0Red Hat: 6 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| ansible-collections | Ansible Community General Collection | 7.1.0 to before 9.5.13; 10.0.0 to before 10.7.6; 11.0.0 to before 11.4.1; 12.0.0 to before 12.2.0 | 9.5.13, 10.7.6, 11.4.1, 12.2.0 | Patch available | CNA |
| Red Hat | Red Hat Ceph Storage 5 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Ceph Storage 6 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Ceph Storage 7 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Ceph Storage 8 | — | — | No fix listed | CNA |
| Red Hat | Red Hat OpenStack Platform 17.1 | — | — | No fix listed | CNA |
| Red Hat | Red Hat OpenStack Platform 18.0 | — | — | No fix listed | CNA |
| — | ansible (PyPI) | before 12.2.0 | 12.2.0 | Patch available | GHSA-8ggh-xwr9-3373 |
- Ansible Community General Collection Vendoransible-collections Affected 7.1.0 to before 9.5.13; 10.0.0 to before 10.7.6; 11.0.0 to before 11.4.1; 12.0.0 to before 12.2.0 Fixed in 9.5.13, 10.7.6, 11.4.1, 12.2.0 Patch available CNA
- Red Hat Ceph Storage 5 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Ceph Storage 6 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Ceph Storage 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Ceph Storage 8 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat OpenStack Platform 17.1 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat OpenStack Platform 18.0 VendorRed Hat Affected — Fixed in — No fix listed CNA
- ansible (PyPI) Vendor— Affected before 12.2.0 Fixed in 12.2.0 Patch available GHSA-8ggh-xwr9-3373
Remediation
- Fix · CNA Ansible Community General Collection (ansible-collections) Fixed in 9.5.13, 10.7.6, 11.4.1, 12.2.0
- Fix · GHSA-8ggh-xwr9-3373 ansible (PyPI) Fixed in 12.2.0 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Ceph Storage 5 | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 6 | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 7 | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 8 | Affected | No fix yet: Fix deferred |
| Red Hat OpenStack Platform 17.1 | Affected | No fix yet: Fix deferred |
| Red Hat OpenStack Platform 18.0 | Affected | No fix yet: Fix deferred |
Timeline
- 2026-10-02 Threatist record created from CVE-2025-14010
- 2026-10-03 Alias added: GHSA-8ggh-xwr9-3373
References
Advisory 3
Other 6
- https://github.com/ansible-collections/community.general/issues/11000
- https://github.com/ansible-collections/community.general/pull/11005
- https://github.com/ansible-community/ansible-build-data/blob/main/12/CHANGELOG-v12.md#security-fixes
- https://github.com/ansible-collections/community.general/commit/08e56bbb9b57740a879d3057d84cdb02a162b840
- https://github.com/ansible-collections/community.general
- https://github.com/ansible-community/ansible-build-data/blob/12.2.0/12/CHANGELOG-v12.md#security-fixes
Sources
- CVE-2025-14010 · CVE Program
- CVE-2025-14010 · NVD
- FIRST EPSS
- GHSA-8ggh-xwr9-3373 · GitHub Advisory Database · CC BY 4.0
- CVE-2025-14010 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences