---
id: CVE-2022-3644
aliases:
  - GHSA-qv37-mfjf-42h8
  - PYSEC-2026-900
title: Plaintext storage of tokens in pulp_ansible
summary: Plaintext storage of tokens in pulp_ansible
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
vendor: pulp-ansible
product: pulp-ansible
ecosystem: pip
affected:
  - pulp-ansible < 0.15.0
patched:
  - pulp-ansible 0.15.0
published: '2022-10-25'
updated: '2026-07-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-qv37-mfjf-42h8'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2022-3644'
  - url: 'https://github.com/pulp/pulp_ansible/issues/1221'
  - url: >-
      https://github.com/pulp/pulp_ansible/commit/d13c427b09482a7f598d8ee597d17a8a34888665
  - url: 'https://github.com/pulp/pulp_ansible'
  - url: >-
      https://github.com/pulp/pulp_ansible/blob/main/pulp_ansible/app/models.py#L234
tags:
  - osv
  - pip
epss: 0.00281
epssPercentile: 0.18339
ingestedAt: '2026-07-08T18:25:52.490Z'
---

## Overview

The collection remote for pulp_ansible stores tokens in plaintext instead of using pulp's encrypted field and exposes them in read/write mode via the API () instead of marking it as write only. 

## Affected packages

- `pulp-ansible < 0.15.0`

## Remediation

Upgrade to a patched release:

- `pulp-ansible 0.15.0`