CVE-2021-20178: Ansible - Disclosure of Credentials in Console Log
Summary
CVE-2021-20178: A flaw was found in ansible module where credentials are disclosed in the console log by default and not protected by the security feature when using the bitbucket_pipeline_variable module. Affects ansible versions < 2.9.18. Fixed in 2.9.18. How to fix ↓
Also tracked for
- ansible · Debian:11
The same CVE-2021-20178 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ansible is an open-source automation tool that allows users to automate IT tasks such as configuration management, application deployment, and orchestration. It is widely used in the industry due to its simplicity and flexibility. The bitbucket_pipeline_variable module in Ansible is responsible for managing credentials in Bitbucket Pipelines, which is a continuous integration and delivery service provided by Bitbucket. This module allows users to set environment variables that can be used in their pipeline scripts. However, a vulnerability in this module exposes these credentials in the console log, making them susceptible to unauthorized access.
Vulnerability Detail
The vulnerability (CVE-2021-20178) in the bitbucket_pipeline_variable module of Ansible allows an attacker to steal Bitbucket Pipeline credentials. By default, the credentials are disclosed in the console log without any protection from the security features. This means that anyone with access to the console log can view and potentially misuse these credentials. The impact of this vulnerability is primarily on the confidentiality of the credentials, as unauthorized individuals can gain access to sensitive information.
How To Fix
Latest published version: 14.5.0 as of 22 Oct 2026
pip install --upgrade "ansible==14.5.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.9.18
This is the first release that contains the fix.
pip install --upgrade "ansible==2.9.18"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version of Ansible is not immediately feasible, users can implement a workaround by manually removing any sensitive credentials from the console log. This can be achieved by modifying the pipeline scripts to avoid printing the credentials or by using environment variables instead of directly exposing the credentials in the log. Here is an example of how to use environment variables in a pipeline script:
- name: Set environment variable
shell: echo 'export MY_SECRET={{ lookup('env', 'MY_SECRET') }}' >> $BITBUCKET_ENV_FILE
- name: Use environment variable
shell: echo $MY_SECRET
Conclusion
In conclusion, the vulnerability (CVE-2021-20178) in the bitbucket_pipeline_variable module of Ansible exposes Bitbucket Pipeline credentials in the console log, compromising their confidentiality. Users are advised to upgrade to Ansible version 2.9.18 or later to fix this vulnerability. Alternatively, a workaround can be implemented by removing sensitive credentials from the console log. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ansible →
FAQ
The vulnerability allows unauthorized individuals to steal Bitbucket Pipeline credentials, compromising the confidentiality of sensitive information.
To fix this vulnerability, upgrade to Ansible version 2.9.18 or later. Alternatively, you can implement a workaround by removing sensitive credentials from the console log.
Yes, you can implement a workaround by modifying your pipeline scripts to avoid printing credentials or by using environment variables instead of exposing the credentials in the log.
Certainly! Here is an example:
-
name: Set environment variable shell: echo 'export MY_SECRET={{ lookup('env', 'MY_SECRET') }}' >> $BITBUCKET_ENV_FILE
-
name: Use environment variable shell: echo $MY_SECRET
You can find more information about this vulnerability in the official advisory from the Python Package Index (PyPI) advisory database. The link to the advisory is provided in the 'affected' section of the vulnerability details.
Related vulnerabilities
Recent vulnerabilities recorded for ansible.
