Description
A flaw was found in Ansible Automation Platform (AAP) where the Gateway API returns the client secret for certain GitHub Enterprise authenticators in clear text. This vulnerability affects administrators or auditors accessing authenticator configurations. While access is limited to privileged users, the clear text exposure of sensitive credentials increases the risk of accidental leaks or misuse.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Ansible | django-ansible-base | < 2025.7.22 | 2025.7.22 |
| Red Hat | Red Hat Ansible Automation Platform 2.5 for RHEL 8 | — | — |
| Red Hat | Red Hat Ansible Automation Platform 2.5 for RHEL 9 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Ansible Automation Platform 2 | automation-gateway-server | 2.5.20250730-2.el8ap | RHSA-2025:12772 |
| Red Hat Ansible Automation Platform 2 | python3.11-django-ansible-base | 2.5.20250730-1.el8ap | RHSA-2025:12772 |
Advisories 2
- RHSA-2025:12772 Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update Red Hat Security Advisories (RHSA) · Aug 13, 2026
- WID-SEC-2025-1592 Red Hat Ansible Automation Platform: Schwachstelle ermöglicht Offenlegung von Informationen BSI CERT-Bund (WID) · Aug 4, 2025