CVE-2019-14864: Ansible - Sensitive Data Disclosure
Summary
CVE-2019-14864: Ansible, versions 2.9.x before 2.9.1, 2.8.x before 2.8.7 and Ansible versions 2.7.x before 2.7.15, is not respecting the flag no_log set it to True when Sumologic and Splunk callback plugins are used send tasks results e... Affects ansible across 3 version ranges.
>= 2.7.0, < 2.7.15
>= 2.8.0, < 2.8.7
>= 2.9.0, < 2.9.1
Fixed in 2.7.15, 2.8.7 or 2.9.1, depending on the release line you run. How to fix ↓
Also tracked for
- ansible · Alpine:v3.10
The same CVE-2019-14864 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ansible is an open-source automation tool that allows users to automate IT infrastructure tasks. It is widely used for configuration management, application deployment, and orchestration. Ansible versions 2.7.x, 2.8.x, and 2.9.x are affected by a vulnerability that allows sensitive data to be disclosed when using the Sumologic and Splunk callback plugins to send task results events to collectors.
Vulnerability Detail
The vulnerability arises from Ansible not respecting the 'no_log' flag set to True when using the Sumologic and Splunk callback plugins. This means that sensitive data, such as passwords or API keys, may be logged and collected by these plugins. This can lead to unauthorized access to sensitive information and potential compromise of systems or data.
How To Fix
Latest published version: 14.5.0 as of 22 Oct 2026
pip install --upgrade "ansible==14.5.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 2.7.0, < 2.7.152.7.15pip install --upgrade "ansible==2.7.15" -
>= 2.8.0, < 2.8.72.8.7pip install --upgrade "ansible==2.8.7" -
>= 2.9.0, < 2.9.12.9.1pip install --upgrade "ansible==2.9.1"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a workaround, users can avoid using the Sumologic and Splunk callback plugins or disable the logging of sensitive data in the plugins' configurations. Here is an example of how to disable logging in the Sumologic plugin:
- Open the Sumologic plugin configuration file.
- Locate the section related to logging.
- Set the appropriate configuration option to disable logging of sensitive data.
- Save the configuration file and restart Ansible.
Conclusion
The vulnerability in Ansible versions 2.7.x, 2.8.x, and 2.9.x allows for the disclosure of sensitive data when using the Sumologic and Splunk callback plugins. Upgrading to the fixed versions or implementing the provided workarounds will mitigate this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for ansible →
FAQ
Ansible is an open-source automation tool used for IT infrastructure tasks such as configuration management and application deployment.
Ansible versions 2.7.x, 2.8.x, and 2.9.x are affected.
This vulnerability can lead to the disclosure of sensitive data, potentially compromising systems or data.
Upgrade to the fixed versions of Ansible: 2.7.15, 2.8.7, or 2.9.1.
Yes, you can avoid using the Sumologic and Splunk callback plugins or disable logging of sensitive data in their configurations.
Related vulnerabilities
Recent vulnerabilities recorded for ansible.
