Description
A flaw was found in ansible-collection-community-general. This vulnerability allows for information exposure (IE) of sensitive credentials, specifically plaintext passwords, via verbose output when running Ansible with debug modes. Attackers with access to logs could retrieve these secrets and potentially compromise Keycloak accounts or administrative access.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| ansible-collections | Ansible Community General Collection | 7.1.0 – < 9.5.13, 10.0.0 – < 10.7.6, 11.0.0 – < 11.4.1, 12.0.0 – < 12.2.0 | 9.5.13 |
| Red Hat | Red Hat Ceph Storage 5 | — | — |
| Red Hat | Red Hat Ceph Storage 6 | — | — |
| Red Hat | Red Hat Ceph Storage 7 | — | — |
| Red Hat | Red Hat Ceph Storage 8 | — | — |
| Red Hat | Red Hat OpenStack Platform 17.1 | — | — |
| Red Hat | Red Hat OpenStack Platform 18.0 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | ansible | 12.2.0+dfsg-1 | — |
| Debian 13 | ansible | 12.0.0+dfsg-0+deb13u1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | ansible +1 | No fix yet | — |
| Ubuntu 26.04 LTS | ansible +1 | No fix yet | — |
| Ubuntu 25.10 | ansible +1 | No fix yet | — |
| Ubuntu 24.04 LTS | ansible +1 | No fix yet | — |
| Ubuntu 22.04 LTS | ansible-core | No fix yet | — |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 22.04 LTS | ansible | No fix yet | — |
| Ubuntu Pro 20.04 LTS | ansible | No fix yet | — |
| Ubuntu Pro 18.04 LTS | ansible | No fix yet | — |
| Ubuntu Pro 16.04 LTS | ansible | No fix yet | — |
| Ubuntu Pro 14.04 LTS | ansible | No fix yet | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | ansible | 8.3.0-1.amzn2023.0.2 | ALAS2023-2025-1330 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | ansible | < 12.2.0 | 12.2.0 | GHSA-8ggh-xwr9-3373 |
Advisories 1
- ALAS2023-2025-1330 Important: ansible security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jan 7, 2026
References
- https://access.redhat.com/security/cve/CVE-2025-14010 vdb-entry
- RHBZ#2418774 issue-tracking
- https://github.com/ansible-collections/community.general/issues/11000
- https://github.com/ansible-collections/community.general/pull/11005
- https://github.com/ansible-community/ansible-build-data/blob/main/12/CHANGELOG-v12.md#security-fixes