CVE-2021-20180: Sensitive Information Disclosure in ansible
Summary
CVE-2021-20180: Insertion of Sensitive Information into Log File in ansible. Affects ansible across 2 version ranges.
>= 2.8.0a1, < 2.8.19
>= 2.9.0b1, < 2.9.18
Fixed in 2.8.19 or 2.9.18, depending on the release line you run. How to fix ↓
Also tracked for
- ansible · Debian:11
The same CVE-2021-20180 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ansible is an open-source automation tool that allows users to automate IT infrastructure tasks. It is widely used for configuration management, application deployment, and orchestration. The vulnerability identified as CVE-2021-20180 affects versions 2.8.0a1 to 2.8.19 and 2.9.0b1 to 2.9.18 of the Ansible package. This vulnerability exposes sensitive information, specifically bitbucket_pipeline credentials, in the console log. The credentials are not protected by the security feature when using the bitbucket_pipeline_variable module.
Vulnerability Detail
The vulnerability arises due to the default behavior of disclosing credentials in the console log without proper protection. An attacker can exploit this flaw to steal bitbucket_pipeline credentials, potentially compromising the confidentiality of the affected system. The severity of this vulnerability is rated as MODERATE with a CVSS score of 5.5.
How To Fix
Latest published version: 14.5.0 as of 22 Oct 2026
pip install --upgrade "ansible==14.5.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 2.8.0a1, < 2.8.192.8.19pip install --upgrade "ansible==2.8.19" -
>= 2.9.0b1, < 2.9.182.9.18pip install --upgrade "ansible==2.9.18"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can avoid using the bitbucket_pipeline_variable module or modify the code to ensure that sensitive information is not logged. Here is an example of how to modify the code:
# Original code
bitbucket_pipeline_variable:
name: my_variable
value: my_value
# Modified code
bitbucket_pipeline_variable:
name: my_variable
value: my_value
no_log: true
By adding the no_log: true parameter, the sensitive information will not be logged.
Conclusion
In conclusion, the CVE-2021-20180 vulnerability in the Ansible package exposes sensitive information in the console log, potentially leading to the theft of bitbucket_pipeline credentials. It is crucial to upgrade to the fixed versions of the Ansible package and implement the recommended fixes to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ansible →
FAQ
Ansible is an open-source automation tool used for configuration management, application deployment, and orchestration.
This vulnerability allows an attacker to steal bitbucket_pipeline credentials, potentially compromising the confidentiality of the affected system.
The severity of this vulnerability is rated as MODERATE with a CVSS score of 5.5.
To fix this vulnerability, it is recommended to upgrade to the fixed versions of the Ansible package. For versions 2.8.0a1 to 2.8.19, upgrade to version 2.8.20 or later. For versions 2.9.0b1 to 2.9.18, upgrade to version 2.9.19 or later.
As a temporary workaround, users can avoid using the bitbucket_pipeline_variable module or modify the code to ensure that sensitive information is not logged.
References
Related vulnerabilities
Recent vulnerabilities recorded for ansible.
