CVE-2021-20191: Sensitive Information Disclosure in ansible
Summary
CVE-2021-20191: Insertion of Sensitive Information into Log File in ansible. Affects ansible across 3 version ranges.
< 2.8.19rc1
>= 2.9.0a1, < 2.9.18rc1
>= 2.10.0a1, < 2.10.7
Fixed in 2.8.19rc1, 2.9.18rc1 or 2.10.7, depending on the release line you run. How to fix ↓
Also tracked for
- ansible · Alpine:v3.10
The same CVE-2021-20191 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ansible is an open-source automation tool that allows users to automate IT infrastructure tasks. It is widely used for configuration management, application deployment, and orchestration. Ansible uses a declarative language to describe system configurations and executes tasks on remote hosts over SSH or PowerShell. This vulnerability affects versions 2.8.0 to 2.8.19, 2.9.0 to 2.9.18, and 2.10.0 to 2.10.7 of the Ansible package.
Vulnerability Detail
The vulnerability (CVE-2021-20191) in Ansible allows sensitive information, such as credentials and secrets, to be logged in the console output by default. This information is not protected by the 'no_log' feature when using certain modules. An attacker can exploit this vulnerability to gain unauthorized access to sensitive data, compromising data confidentiality. The Common Vulnerability Scoring System (CVSS) score for this vulnerability is 5.5, indicating a moderate severity level.
How To Fix
Latest published version: 14.5.0 as of 22 Oct 2026
pip install --upgrade "ansible==14.5.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.8.19rc12.8.19rc1pip install --upgrade "ansible==2.8.19rc1" -
>= 2.9.0a1, < 2.9.18rc12.9.18rc1pip install --upgrade "ansible==2.9.18rc1" -
>= 2.10.0a1, < 2.10.72.10.7pip install --upgrade "ansible==2.10.7"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can manually modify their Ansible playbooks to include the 'no_log: true' parameter for modules that handle sensitive information. This will prevent the sensitive data from being logged in the console output. Here's an example:
- name: Example playbook
hosts: all
tasks:
- name: Task that handles sensitive information some_module: parameter1: value1 parameter2: value2 no_log: true
Conclusion
The vulnerability (CVE-2021-20191) in Ansible allows sensitive information to be logged in the console output, potentially compromising data confidentiality. It is crucial to upgrade to the latest patched version of Ansible to mitigate this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for ansible →
FAQ
Ansible is an open-source automation tool used for configuration management, application deployment, and orchestration of IT infrastructure tasks.
This vulnerability allows sensitive information, such as credentials and secrets, to be disclosed in the console log. An attacker can exploit this information to steal sensitive data, compromising data confidentiality.
Versions 2.8.0 to 2.8.19, 2.9.0 to 2.9.18, and 2.10.0 to 2.10.7 of the Ansible package are affected by this vulnerability.
The CVSS score for this vulnerability is 5.5, indicating a moderate severity level.
To fix this vulnerability, it is recommended to upgrade to the latest patched version of Ansible. Refer to the 'how_to_fix' section for specific version recommendations.
References
Related vulnerabilities
Recent vulnerabilities recorded for ansible.
