CVE-2018-10855: Ansible - Sensitive Data Exposure in Log Files
Summary
CVE-2018-10855: Ansible 2.5 prior to 2.5.5, and 2.4 prior to 2.4.5, do not honor the no_log task flag for failed tasks. Affects ansible across 2 version ranges.
>= 2.4, < 2.4.5.0
>= 2.5, < 2.5.5
Fixed in 2.4.5.0 or 2.5.5, depending on the release line you run. How to fix ↓
Also tracked for
- ansible · Alpine:v3.7
The same CVE-2018-10855 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ansible is an open-source automation tool that allows users to automate IT tasks such as configuration management, application deployment, and orchestration. It is widely used for managing infrastructure and automating repetitive tasks. Ansible uses a declarative language to describe system configurations and executes tasks on remote hosts over SSH or PowerShell. This vulnerability affects Ansible versions 2.5 prior to 2.5.5 and 2.4 prior to 2.4.5.
Vulnerability Detail
The vulnerability (CVE-2018-10855) in Ansible arises from a failure to honor the 'no_log' task flag for failed tasks. When the 'no_log' flag is used to protect sensitive data from being logged, and a task that uses this flag fails, Ansible will expose the sensitive data in log files and on the terminal of the user running Ansible. This can lead to the inadvertent exposure of sensitive information, such as passwords or API keys, which could be exploited by attackers.
How To Fix
Latest published version: 14.5.0 as of 22 Oct 2026
pip install --upgrade "ansible==14.5.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 2.4, < 2.4.5.02.4.5.0pip install --upgrade "ansible==2.4.5.0" -
>= 2.5, < 2.5.52.5.5pip install --upgrade "ansible==2.5.5"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a workaround, users can modify their Ansible playbooks to avoid passing sensitive data to tasks that may fail. This can be achieved by using Ansible's 'when' condition to check for the success of a previous task before executing a task that requires sensitive data. By doing so, the sensitive data will not be exposed in log files or on the terminal if the task fails.
Conclusion
In conclusion, the vulnerability (CVE-2018-10855) in Ansible exposes sensitive data in log files and on the terminal when the 'no_log' task flag is not honored for failed tasks. Users should upgrade to the fixed versions of Ansible (2.5.5 or 2.4.5) to mitigate this vulnerability. Alternatively, they can implement a workaround by modifying their playbooks to avoid passing sensitive data to potentially failing tasks. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ansible →
FAQ
Ansible is an open-source automation tool used for configuration management, application deployment, and orchestration.
Ansible versions 2.5 prior to 2.5.5 and 2.4 prior to 2.4.5 are affected by this vulnerability.
This vulnerability can lead to the exposure of sensitive data, such as passwords or API keys, in log files and on the terminal of the user running Ansible.
To fix this vulnerability, users should upgrade to Ansible versions 2.5.5 or 2.4.5, depending on the currently installed version.
Yes, users can modify their Ansible playbooks to avoid passing sensitive data to tasks that may fail.
Related vulnerabilities
Recent vulnerabilities recorded for ansible.
