CVE-2025-2877
MEDIUMCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
3Description
A flaw was found in the Ansible Automation Platform's Event-Driven Ansible. In configurations where verbosity is set to "debug", inventory passwords are exposed in plain text when starting a rulebook activation. This issue exists for any "debug" action in a rulebook and also affects Event Streams.
Analysis
Ansible Automation Platform's Event-Driven Ansible exposes inventory passwords in plain text when debug verbosity is enabled during rulebook activation, affecting both standard debug actions and Event Streams configurations. Authenticated users with access to debug-enabled ruleebooks can retrieve plaintext credentials through logs or console output. With CVSS 6.5 and EPSS 0.26% (percentile 49%), this represents moderate severity; no active exploitation has been confirmed, but the low complexity and authenticated-only requirement (PR:L) make this a practical concern for organizations using debug-level logging in production environments.
Technical Context
The vulnerability stems from CWE-1295 (Improper Neutralization of Sensitive Information in Logs), a root cause involving improper redaction or filtering of sensitive data during logging operations. Event-Driven Ansible, part of the Red Hat Ansible Automation Platform, processes rulebook activations and Event Streams configurations; when verbosity is set to debug level, the logging mechanism fails to mask credentials that are part of inventory definitions. This affects the rulebook execution engine's interaction with inventory management and credential handling, where plaintext passwords should be redacted before being written to debug output or console streams. The issue spans both standard debug actions and Event Streams integrations, indicating a systemic logging control gap rather than isolated code path.
Affected Products
Ansible Automation Platform Event-Driven Ansible is affected; specific version ranges are not detailed in provided references, but Red Hat has issued security advisories RHSA-2025:3636 and RHSA-2025:3637 indicating fixes are available. The vulnerability also impacts Event Streams configurations integrated with Event-Driven Ansible. An upstream fix is documented in ansible/ansible-rulebook pull request 767 on GitHub (https://github.com/ansible/ansible-rulebook/pull/767). Organizations should consult the Red Hat security advisories at https://access.redhat.com/errata/RHSA-2025:3636 and https://access.redhat.com/errata/RHSA-2025:3637 for precise affected versions and patch availability.
Remediation
Apply patches from Red Hat advisory RHSA-2025:3636 and RHSA-2025:3637 (https://access.redhat.com/errata/RHSA-2025:3636 and https://access.redhat.com/errata/RHSA-2025:3637) to update Ansible Automation Platform Event-Driven Ansible to a patched version. Until patching is complete, disable debug-level verbosity in production rulebook activations-use info or warning levels instead, restricting debug mode to isolated test environments. Implement log aggregation with automatic credential redaction rules (masking patterns for passwords, tokens, and API keys) and restrict direct console/log file access via file system permissions or role-based access controls to trusted operators only. Review Event Streams configurations for debug settings and align them with the same logging policies.
Priority Score
Vendor Status
Share
External POC / Exploit Code
Leaving vuln.today