Ansible-core: exposure of sensitive information in ansible vault files due to improper logging

Summary

A flaw was found in Ansible, where sensitive information stored in Ansible Vault files can be exposed in plaintext during the execution of a playbook. This occurs when using tasks such as include_vars to load vaulted variables without setting the no_log: true parameter, resulting in sensitive data being printed in the playbook output or logs. This can lead to the unintentional disclosure of secrets like passwords or API keys, compromising security and potentially allowing unauthorized access or actions.

Timeline

1. Sep 14, 2024, 2:15 AM UTCCVE published
2. Sep 16, 2024, 2:21 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: partial

3. Sep 17, 2026, 6:54 PM UTCRecord last updated

Affected versions

• ansible-core

  From 1.0.0 · through 2.17.4

• ansible-automation-platform/ansible-builder-rhel8

  Version range not reported

• ansible-automation-platform/ansible-builder-rhel9

  Version range not reported

• ansible-automation-platform/ee-29-rhel8

  Version range not reported

• ansible-automation-platform/ee-minimal-rhel8

  Version range not reported

• ansible-automation-platform/ee-minimal-rhel9

  Version range not reported

• discovery/discovery-server-rhel9

  Version range not reported

• discovery/discovery-ui-rhel9

  Version range not reported

• ansible-core

  Version range not reported

• ansible-core

  Version range not reported

• ansible-core

  Version range not reported

• ansible-core

  Version range not reported

• ansible-core

  Version range not reported

• ansible-core

  Version range not reported

• ansible-core

  Version range not reported

• rhelai1/bootc-nvidia-rhel9

  Version range not reported

• ansible-corePyPI

  fixed in 2.16.13; From 2.17.0b1 · fixed in 2.17.6

• ansible-corePyPI

  From 2.17.0b1 · fixed in 2.17.6

• ansible-corePyPI

  fixed in 2.16.13

References 7