CVE-2025-14010

A flaw was found in ansible-collection-community-general. This vulnerability allows for information exposure (IE) of sensitive credentials, specifically plaintext passwords, via verbose output when running Ansible with debug modes. Attackers with access to logs could retrieve these secrets and potentially compromise Keycloak accounts or administrative access.

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://access.redhat.com/security/cve/CVE-2025-14010	Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2418774	Issue Tracking Vendor Advisory
https://github.com/ansible-collections/community.general/issues/11000
https://github.com/ansible-collections/community.general/pull/11005
https://github.com/ansible-community/ansible-build-data/blob/main/12/CHANGELOG-v12.md#security-fixes
https://github.com/ansible-collections/community.general/issues/11000

Configurations

Configuration 1 (hide)

cpe:2.3:a:redhat:community.general:-:*:*:*:*:*:*:*

History

18 Oct 2026, 17:10

Type	Values Removed	Values Added
Summary		(es) Se encontró una falla en ansible-collection-community-general. Esta vulnerabilidad permite la exposición de información (IE) de credenciales sensibles, específicamente contraseñas en texto plano, mediante la salida detallada al ejecutar Ansible con modos de depuración. Atacantes con acceso a los registros podrían recuperar estos secretos y potencialmente comprometer cuentas de Keycloak o el acceso administrativo.

Information

Published : 2025-12-04 10:16

Updated : 2026-10-18 17:10

NVD link : CVE-2025-14010

Mitre link : CVE-2025-14010

CVE.ORG link : CVE-2025-14010

JSON object : View

Products Affected

redhat

community.general

CWE

CWE-532

Insertion of Sensitive Information into Log File

{"id": "CVE-2025-14010", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-14010", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-20T13:11:04.005176Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "affected": [{"source": "secalert@redhat.com", "affectedData": [{"vendor": "ansible-collections", "product": "Ansible Community General Collection", "versions": [{"status": "affected", "version": "7.1.0", "lessThan": "9.5.13", "versionType": "semver"}, {"status": "affected", "version": "10.0.0", "lessThan": "10.7.6", "versionType": "semver"}, {"status": "affected", "version": "11.0.0", "lessThan": "11.4.1", "versionType": "semver"}, {"status": "affected", "version": "12.0.0", "lessThan": "12.2.0", "versionType": "semver"}], "packageName": "ansible-collection-community-general", "collectionURL": "https://github.com/ansible-collections/community.general", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:ceph_storage:5"], "vendor": "Red Hat", "product": "Red Hat Ceph Storage 5", "packageName": "ansible-collection-community-general", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:ceph_storage:6"], "vendor": "Red Hat", "product": "Red Hat Ceph Storage 6", "packageName": "ansible-collection-community-general", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:ceph_storage:7"], "vendor": "Red Hat", "product": "Red Hat Ceph Storage 7", "packageName": "ansible-collection-community-general", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:ceph_storage:8"], "vendor": "Red Hat", "product": "Red Hat Ceph Storage 8", "packageName": "ansible-collection-community-general", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openstack:17.1"], "vendor": "Red Hat", "product": "Red Hat OpenStack Platform 17.1", "packageName": "ansible-collection-community-general", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openstack:18.0"], "vendor": "Red Hat", "product": "Red Hat OpenStack Platform 18.0", "packageName": "ansible-collection-community-general", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}]}], "published": "2025-12-04T10:16:00.810", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2025-14010", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418774", "tags": ["Issue Tracking", "Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "https://github.com/ansible-collections/community.general/issues/11000", "source": "secalert@redhat.com"}, {"url": "https://github.com/ansible-collections/community.general/pull/11005", "source": "secalert@redhat.com"}, {"url": "https://github.com/ansible-community/ansible-build-data/blob/main/12/CHANGELOG-v12.md#security-fixes", "source": "secalert@redhat.com"}, {"url": "https://github.com/ansible-collections/community.general/issues/11000", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-532"}]}], "descriptions": [{"lang": "en", "value": "A flaw was found in ansible-collection-community-general. This vulnerability allows for information exposure (IE) of sensitive credentials, specifically plaintext passwords, via verbose output when running Ansible with debug modes. Attackers with access to logs could retrieve these secrets and potentially compromise Keycloak accounts or administrative access."}, {"lang": "es", "value": "Se encontr\u00f3 una falla en ansible-collection-community-general. Esta vulnerabilidad permite la exposici\u00f3n de informaci\u00f3n (IE) de credenciales sensibles, espec\u00edficamente contrase\u00f1as en texto plano, mediante la salida detallada al ejecutar Ansible con modos de depuraci\u00f3n. Atacantes con acceso a los registros podr\u00edan recuperar estos secretos y potencialmente comprometer cuentas de Keycloak o el acceso administrativo."}], "lastModified": "2026-10-18T17:10:00.110", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:redhat:community.general:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FFB54908-462D-4CE6-9AB2-56997B0EFB79"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}