{"id":"CVE-2022-3644","aliases":["GHSA-qv37-mfjf-42h8","PYSEC-2026-900"],"title":"Plaintext storage of tokens in pulp_ansible","summary":"Plaintext storage of tokens in pulp_ansible","severity":"medium","cvss":5.5,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","vendor":"pulp-ansible","product":"pulp-ansible","ecosystem":"pip","affected":["pulp-ansible < 0.15.0"],"patched":["pulp-ansible 0.15.0"],"published":"2022-10-25","updated":"2026-07-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-qv37-mfjf-42h8","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-3644"},{"url":"https://github.com/pulp/pulp_ansible/issues/1221"},{"url":"https://github.com/pulp/pulp_ansible/commit/d13c427b09482a7f598d8ee597d17a8a34888665"},{"url":"https://github.com/pulp/pulp_ansible"},{"url":"https://github.com/pulp/pulp_ansible/blob/main/pulp_ansible/app/models.py#L234"}],"tags":["osv","pip"],"epss":0.00281,"epssPercentile":0.20909,"ingestedAt":"2026-07-08T18:25:52.490Z","slug":"CVE-2022-3644","body":"## Overview\n\nThe collection remote for pulp_ansible stores tokens in plaintext instead of using pulp's encrypted field and exposes them in read/write mode via the API () instead of marking it as write only. \n\n## Affected packages\n\n- `pulp-ansible < 0.15.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `pulp-ansible 0.15.0`","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":30.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}