CVE-2019-14846: Ansible - Disclosure of Credentials via DEBUG Logging
Summary
CVE-2019-14846: In Ansible, all Ansible Engine versions up to ansible-engine 2.8.5, ansible-engine 2.7.13, ansible-engine 2.6.19, were logging at the DEBUG level which lead to a disclosure of credentials if a plugin used a library that... Affects ansible across 3 version ranges.
< 2.6.20
>= 2.7.0, < 2.7.14
>= 2.8.0, < 2.8.6
Fixed in 2.6.20, 2.7.14 or 2.8.6, depending on the release line you run. How to fix ↓
Also tracked for
- ansible-core · PyPI
- ansible · Alpine:v3.10
The same CVE-2019-14846 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ansible is an open-source automation tool that allows users to automate IT tasks such as configuration management, application deployment, and orchestration. It is widely used in the industry due to its simplicity and flexibility. Ansible Engine versions up to ansible-engine 2.8.5, ansible-engine 2.7.13, ansible-engine 2.6.19 were affected by a vulnerability that allowed the disclosure of credentials if a plugin used a library that logged credentials at the DEBUG level. This flaw did not impact Ansible modules, as they are executed in a separate process.
Vulnerability Detail
The vulnerability in Ansible allowed for the disclosure of credentials when a plugin used a library that logged credentials at the DEBUG level. This means that if a plugin within Ansible logged sensitive information such as passwords or API keys at the DEBUG level, those credentials could be exposed in the logs. An attacker with access to the logs could potentially obtain these credentials and misuse them. It is important to note that this vulnerability did not affect Ansible modules, as they are executed in a separate process.
How To Fix
Latest published version: 14.5.0 as of 22 Oct 2026
pip install --upgrade "ansible==14.5.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.6.202.6.20pip install --upgrade "ansible==2.6.20" -
>= 2.7.0, < 2.7.142.7.14pip install --upgrade "ansible==2.7.14" -
>= 2.8.0, < 2.8.62.8.6pip install --upgrade "ansible==2.8.6"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can mitigate the risk by ensuring that sensitive information is not logged at the DEBUG level in any custom plugins or libraries used within Ansible.
Conclusion
In conclusion, the vulnerability in Ansible allowed for the disclosure of credentials if a plugin used a library that logged credentials at the DEBUG level. To mitigate this issue, it is recommended to update to the fixed versions of Ansible. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for ansible →
FAQ
Ansible is an open-source automation tool used for configuration management, application deployment, and orchestration.
All Ansible Engine versions up to ansible-engine 2.8.5, ansible-engine 2.7.13, ansible-engine 2.6.19 are affected.
No, Ansible modules are executed in a separate process and are not affected by this vulnerability.
The vulnerability could lead to the disclosure of sensitive credentials if a plugin used a library that logged credentials at the DEBUG level. An attacker with access to the logs could potentially obtain these credentials.
To fix this vulnerability, update to the fixed versions of Ansible: ansible-engine 2.6.20, ansible-engine 2.7.14, ansible-engine 2.8.6.
Related vulnerabilities
Recent vulnerabilities recorded for ansible.
