---
id: CVE-2025-14010
aliases:
  - GHSA-8ggh-xwr9-3373
  - PYSEC-2026-1119
title: >-
  Ansible Community General Collection is vulnerable to exposure of sensitive
  information
summary: >-
  Ansible Community General Collection is vulnerable to exposure of sensitive
  information
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
vendor: ansible
product: ansible
ecosystem: pip
affected:
  - ansible < 12.2.0
patched:
  - ansible 12.2.0
published: '2025-12-04'
updated: '2026-07-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-8ggh-xwr9-3373'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-14010'
  - url: 'https://github.com/ansible-collections/community.general/issues/11000'
  - url: >-
      https://github.com/ansible-collections/community.general/commit/08e56bbb9b57740a879d3057d84cdb02a162b840
  - url: 'https://access.redhat.com/security/cve/CVE-2025-14010'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2418774'
  - url: 'https://github.com/ansible-collections/community.general'
  - url: >-
      https://github.com/ansible-community/ansible-build-data/blob/12.2.0/12/CHANGELOG-v12.md#security-fixes
tags:
  - osv
  - pip
epss: 0.00135
epssPercentile: 0.02401
ingestedAt: '2026-07-08T18:25:47.488Z'
---

## Overview

A flaw was found in ansible-collection-community-general. This vulnerability allows for information exposure (IE) of sensitive credentials, specifically plaintext passwords, via verbose output when running Ansible with debug modes. Attackers with access to logs could retrieve these secrets and potentially compromise Keycloak accounts or administrative access.

## Affected packages

- `ansible < 12.2.0`

## Remediation

Upgrade to a patched release:

- `ansible 12.2.0`