Description
A flaw was found in Ansible, where sensitive information stored in Ansible Vault files can be exposed in plaintext during the execution of a playbook. This occurs when using tasks such as include_vars to load vaulted variables without setting the no_log: true parameter, resulting in sensitive data being printed in the playbook output or logs. This can lead to the unintentional disclosure of secrets like passwords or API keys, compromising security and potentially allowing unauthorized access or actions.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | ansible-core | 1.0.0 – ≤ 2.17.4 | — |
| Red Hat | Ansible Automation Platform Execution Environments | — | — |
| Red Hat | Discovery 1 for RHEL 9 | — | — |
| Red Hat | Red Hat Ansible Automation Platform 2.4 for RHEL 8 | — | — |
| Red Hat | Red Hat Ansible Automation Platform 2.4 for RHEL 9 | — | — |
| Red Hat | Red Hat Ansible Automation Platform 2.5 for RHEL 8 | — | — |
| Red Hat | Red Hat Ansible Automation Platform 2.5 for RHEL 9 | — | — |
| Red Hat | Red Hat Enterprise Linux 10 | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Red Hat | Red Hat Enterprise Linux AI (RHEL AI) | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | ansible | 5.4.0-1 | — |
| Debian 14 | ansible-core | 2.17.5-5 | — |
| Debian 13 | ansible | 5.4.0-1 | — |
| Debian 13 | ansible-core | 2.17.5-5 | — |
| Debian 12 | ansible | 5.4.0-1 | — |
| Debian 12 | ansible-core | 2.14.18-0+deb12u1 | — |
| Debian 11 | ansible | 2.10.7+merged+base+2.10.17+dfsg-0+deb11u2 | DLA-3963-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | ansible +1 | No fix yet | — |
| Ubuntu 26.04 LTS | ansible +1 | No fix yet | — |
| Ubuntu 25.10 | ansible +1 | No fix yet | — |
| Ubuntu 24.04 LTS | ansible +1 | No fix yet | — |
| Ubuntu 22.04 LTS | ansible-core | No fix yet | — |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 22.04 LTS | ansible | No fix yet | — |
| Ubuntu Pro 20.04 LTS | ansible | No fix yet | — |
| Ubuntu Pro 18.04 LTS | ansible | No fix yet | — |
| Ubuntu Pro 16.04 LTS | ansible | No fix yet | — |
| Ubuntu Pro 14.04 LTS | ansible | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Ansible Automation Platform Inside 2 | ansible-core | 1:2.15.13-1.el8ap | RHSA-2024:10762, RHSA-2024:9894 |
| Red Hat Ansible Automation Platform Developer 2 | ansible-core | 1:2.15.13-1.el8ap | RHSA-2024:10762, RHSA-2024:9894 |
| Red Hat Ansible Automation Platform 2 | ansible-core | 1:2.15.13-1.el8ap | RHSA-2024:10762, RHSA-2024:9894 |
| Red Hat Ansible Automation Platform 2 | automation-controller-venv-tower | 4.5.13-1.el8ap | RHSA-2024:10762 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Manager Proxy Module 4.3 | ansible | 2.9.27-150000.1.20.1 | SUSE-RU-2025:0791-1 |
| SUSE Manager Proxy Module 4.3 | uyuni-proxy-systemd-services | 4.3.15-150000.1.30.1 | SUSE-RU-2025:0791-1 |
| SUSE Manager Client Tools for SLE Micro 5 | uyuni-proxy-systemd-services | 4.3.15-150000.1.30.1 | SUSE-RU-2025:0791-1 |
| SUSE Manager Client Tools 15 | ansible | 2.9.27-150000.1.20.1 | SUSE-RU-2025:0791-1 |
| SUSE Manager Client Tools 15 | spacewalk-client-tools | 4.3.22-150000.3.100.1 | SUSE-RU-2025:0791-1 |
| SUSE Manager Client Tools 15 | uyuni-proxy-systemd-services | 4.3.15-150000.1.30.1 | SUSE-RU-2025:0791-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | ansible-core +1 | 2.17.6-1.1 | openSUSE-SU-2024:14537-1, openSUSE-SU-2024:14498-1 |
| openSUSE Tumbleweed | ansible-core-2.16 | 2.16.13-1.1 | openSUSE-SU-2024:14499-1 |
| openSUSE Tumbleweed | ansible-core-2.18 | 2.18.10-2.1 | openSUSE-SU-2025:15638-1 |
| openSUSE Tumbleweed | ansible-core-2.19 | 2.19.4-1.1 | openSUSE-SU-2025:15754-1 |
| openSUSE Tumbleweed | ansible-core-2.20 | 2.20.6-1.1 | openSUSE-SU-2026:10945-1 |
| openSUSE Tumbleweed | ansible-core-2.21 | 2.21.6-1.1 | openSUSE-SU-2026:12451-1 |
| openSUSE Leap 15.6 | ansible | 2.9.27-150000.1.20.1 | SUSE-RU-2025:0791-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | ansible-core +1 | 2.15.3-1.amzn2023.0.8 | ALAS2023-2025-846 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | ansible | 2.17.11-1 | — |
| Azure Linux 2 (CBL-Mariner) | ansible | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | ansible-core | >= 2.17.0b1, < 2.17.6 | 2.17.6 | GHSA-jpxc-vmjf-9fcj |
| PyPI | ansible-core | < 2.16.13 | 2.16.13 | GHSA-jpxc-vmjf-9fcj |
| PyPI | ansible-core | < 2.16.13 · >= 2.17.0b1, < 2.17.6 | 2.16.13, 2.17.6 | PYSEC-2026-1124 |
Advisories 13
- openSUSE-SU-2026:12451-1 ansible-core-2.21-2.21.6-1.1 on GA media SUSE / openSUSE Security Updates · Nov 7, 2026
- RHSA-2024:10762 Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2024:9894 Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Release Update Red Hat Security Advisories (RHSA) · Sep 18, 2026
- WID-SEC-2024-2151 Ansible: Schwachstelle ermöglicht Offenlegung von Informationen BSI CERT-Bund (WID) · Jun 7, 2026
- openSUSE-SU-2026:10945-1 ansible-core-2.20-2.20.6-1.1 on GA media SUSE / openSUSE Security Updates · Jun 4, 2026
- openSUSE-SU-2025:15638-1 ansible-core-2.18-2.18.10-2.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- DLA-3963-1 ansible - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:14499-1 ansible-core-2.16-2.16.13-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:14498-1 ansible-core-2.17.6-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-RU-2025:0791-1 Recommended update 4.3.15 for Multi-Linux Manager Client Tools SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2025:15754-1 ansible-core-2.19-2.19.4-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:14537-1 ansible-core-2.17-2.17.6-1.1 on GA media SUSE / openSUSE Security Updates · May 7, 2025
- ALAS2023-2025-846 Moderate: ansible-core security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Feb 21, 2025
References
- RHSA-2024:10762 vendor-advisory
- RHSA-2024:8969 vendor-advisory
- RHSA-2024:9894 vendor-advisory
- RHSA-2025:1249 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2024-8775 vdb-entry
- RHBZ#2312119 issue-tracking
- https://github.com/advisories/GHSA-jpxc-vmjf-9fcj