{"id":"CVE-2022-3697","aliases":["GHSA-cpx3-93w7-457x","PYSEC-2026-768"],"title":"Ansible leaks password to logs","summary":"Ansible leaks password to logs","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","vendor":"ansible","product":"ansible","ecosystem":"pip","affected":["ansible >= 2.5.0, < 7.0.0"],"patched":["ansible 7.0.0"],"published":"2022-10-28","updated":"2026-07-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-cpx3-93w7-457x","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-3697"},{"url":"https://github.com/ansible-collections/amazon.aws/pull/1199"},{"url":"https://github.com/ansible/ansible/pull/35749"},{"url":"https://github.com/ansible-community/ansible-build-data/blob/main/6/CHANGELOG-v6.rst"},{"url":"https://github.com/ansible/ansible"},{"url":"https://lists.debian.org/debian-lts-announce/2023/12/msg00018.html"}],"tags":["osv","pip"],"epss":0.00766,"epssPercentile":0.53527,"ingestedAt":"2026-07-08T18:25:48.520Z","slug":"CVE-2022-3697","body":"## Overview\n\nA flaw was found in Ansible in the amazon.aws collection when using the `tower_callback` parameter from the `amazon.aws.ec2_instance` module. This flaw allows an attacker to take advantage of this issue as the module is handling the parameter insecurely, leading to the password leaking in the logs.\n\n## Affected packages\n\n- `ansible >= 2.5.0, < 7.0.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `ansible 7.0.0`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}