Ansible
CVE-2025-2877
MEDIUM
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Hardware debug lock mechanism
|
| Impact | CVSS 6.5 (Confidentiality High, Integrity None, Availability None) with Network/Low-Complexity/Low-Privilege authentication reflects moderate severity limited to authenticated users without privilege escalation. However, EPSS 0.26% percentile 49 indicates low real-world exploitation probability-below median-suggesting this is primarily a misconfiguration risk rather than an active attack vector. No CISA KEV status or public exploit confirmation is documented, meaning no confirmed active exploitation exists. The practical risk concentrates on organizations that (1) enable debug verbosity in production environments, (2) fail to restrict access to logs/console output, and (3) lack log aggregation with redaction controls. This is a real priority for compliance-sensitive environments (payment systems, healthcare) where plaintext credential exposure violates auditing standards, but lower priority for development-only or tightly access-controlled scenarios. |
| Exploit ScenarioDerived | An authenticated Ansible Automation Platform user with permission to view rulebook execution logs enables a debug-level rulebook activation that uses inventory credentials. When the rulebook executes, debug output containing plaintext inventory passwords is written to the execution log or console. A second user or process with read access to those logs (e.g., a SOAR platform monitoring all platform logs, a junior administrator checking execution status) retrieves the plaintext passwords and uses them to access the managed infrastructure directly, bypassing Ansible's credential management controls. This scenario is realistic in environments where log aggregation or monitoring tools have broad read access and where multiple team members can view execution artifacts. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 20, 2026
Ansible Automation Platform's Event-Driven Ansible exposes inventory passwords in plain text when debug verbosity is enabled during rulebook activation, affecting both standard debug actions and Event Streams configurations. Authenticated users with access to debug-enabled ruleebooks can retrieve plaintext credentials through logs or console output. With CVSS 6.5 and EPSS 0.26% (percentile 49%), this represents moderate severity; no active exploitation has been confirmed, but the low complexity and authenticated-only requirement (PR:L) make this a practical concern for organizations using debug-level logging in production environments.
RemediationAI
Apply patches from Red Hat advisory RHSA-2025:3636 and RHSA-2025:3637 (https://access.redhat.com/errata/RHSA-2025:3636 and https://access.redhat.com/errata/RHSA-2025:3637) to update Ansible Automation Platform Event-Driven Ansible to a patched version. Until patching is complete, disable debug-level verbosity in production rulebook activations-use info or warning levels instead, restricting debug mode to isolated test environments. Implement log aggregation with automatic credential redaction rules (masking patterns for passwords, tokens, and API keys) and restrict direct console/log file access via file system permissions or role-based access controls to trusted operators only. Review Event Streams configurations for debug settings and align them with the same logging policies.
Affected ProductsAI
Ansible Automation Platform Event-Driven Ansible is affected; specific version ranges are not detailed in provided references, but Red Hat has issued security advisories RHSA-2025:3636 and RHSA-2025:3637 indicating fixes are available. The vulnerability also impacts Event Streams configurations integrated with Event-Driven Ansible. An upstream fix is documented in ansible/ansible-rulebook pull request 767 on GitHub (https://github.com/ansible/ansible-rulebook/pull/767). Organizations should consult the Red Hat security advisories at https://access.redhat.com/errata/RHSA-2025:3636 and https://access.redhat.com/errata/RHSA-2025:3637 for precise affected versions and patch availability.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability stems from CWE-1295 (Improper Neutralization of Sensitive Information in Logs), a root cause involving improper redaction or filtering of sensitive data during logging operations. Event-Driven Ansible, part of the Red Hat Ansible Automation Platform, processes rulebook activations and Event Streams configurations; when verbosity is set to debug level, the logging mechanism fails to mask credentials that are part of inventory definitions. This affects the rulebook execution engine's interaction with inventory management and credential handling, where plaintext passwords should be redacted before being written to debug output or console streams. The issue spans both standard debug actions and Event Streams integrations, indicating a systemic logging control gap rather than isolated code path.
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in the Ansible Automation Platform's Event-Driven Ansible. In configurations where verbosity is set to "debug", inventory passwords are exposed in plain text when starting a rulebook activation. This issue exists for any "debug" action in a rulebook and also affects Event Streams.
Executive ViewAI
Organizations using A flaw should be aware of notable risk from CVE-2025-2877 rated CVSS 6.5. Exploitation could compromise the security of affected deployments. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: restrict network access and enable monitoring.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Ansible Tower (aka Ansible UI) before 2.0.5 allows remote attackers to bypass authentication and obtain sensitive inform
Ansible Tower (aka Ansible UI) before 2.0.5 allows remote organization administrators to gain privileges by creating a s
Multiple cross-site scripting (XSS) vulnerabilities in Ansible Tower (aka Ansible UI) before 2.0.5 allow remote attacker
A flaw was found in ansible 2.8.0 before 2.8.4. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploit
A flaw was found in the way Ansible (2.3.x before 2.3.3, and 2.4.x before 2.4.1) passed certain parameters to the jenkin
Confluent Ansible (cp-ansible) version 5.5.0, 5.5.1, 5.5.2 and 6.0.0 is vulnerable to Incorrect Access Control via its a
A race condition flaw was found in Ansible Engine 2.7.17 and prior, 2.8.9 and prior, 2.9.6 and prior when running a play
The user module in ansible before 1.6.6 allows remote authenticated users to execute arbitrary commands. Rated high seve
Symlink-following file overwrite on the Ansible control node is possible in ansible-core when a user runs `ansible-galax
A flaw was found in the Ansible Engine when the fetch module is used. Rated medium severity (CVSS 4.6), this vulnerabili
Remote code execution via unsafe Python pickle deserialization in the community.general Ansible collection's memcached f
The chroot, jail, and zone connection plugins in ansible before 1.9.2 allow local users to escape a restricted environme
Exploit-DB