PYSEC-2026-1124
Ansible vulnerable to Insertion of Sensitive Information into Log File
At a glance
- Published
- Updated
- CVE
- CVE-2024-8775
- Aliases
- GHSA-jpxc-vmjf-9fcj
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- CVSS_V4
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Description
A flaw was found in Ansible, where sensitive information stored in Ansible Vault files can be exposed in plaintext during the execution of a playbook. This occurs when using tasks such as include_vars to load vaulted variables without setting the no_log: true parameter, resulting in sensitive data being printed in the playbook output or logs. This can lead to the unintentional disclosure of secrets like passwords or API keys, compromising security and potentially allowing unauthorized access or actions.
Affected packages
| Package | Versions |
|---|---|
| PyPI · ansible-core | introduced 0, fixed 2.16.13, introduced 2.17.0b1, fixed 2.17.6 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2024-8775 ADVISORY
- https://github.com/ansible/ansible/commit/8a87e1c5d37422bc99d27ad4237d185cc233e035 WEB
- https://access.redhat.com/errata/RHSA-2024:10762 WEB
- https://access.redhat.com/errata/RHSA-2024:8969 WEB
- https://access.redhat.com/errata/RHSA-2024:9894 WEB
- https://access.redhat.com/errata/RHSA-2025:1249 WEB
- https://access.redhat.com/security/cve/CVE-2024-8775 WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=2312119 WEB
- https://github.com/advisories/GHSA-jpxc-vmjf-9fcj ADVISORY
- https://github.com/ansible/ansible PACKAGE
- https://github.com/ansible/ansible/blob/v2.16.13/changelogs/CHANGELOG-v2.16.rst#security-fixes WEB
- https://github.com/ansible/ansible/blob/v2.17.6/changelogs/CHANGELOG-v2.17.rst#security-fixes WEB
- https://lists.debian.org/debian-lts-announce/2024/11/msg00021.html WEB
- https://pypi.org/project/ansible-core PACKAGE
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — PyPA Advisory Database |