Ansible Password Prompts Vulnerability (CVE-2019-14856)
Summary
CVE-2019-14856: Ansible password prompts could expose passwords. Affects ansible across 3 version ranges.
>= 2.6.0, < 2.6.20
>= 2.7.0, < 2.7.14
>= 2.8.0, < 2.8.6
Fixed in 2.6.20, 2.7.14 or 2.8.6, depending on the release line you run. How to fix ↓
Also tracked for
- ansible · Alpine:v3.10
The same CVE-2019-14856 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ansible is an open-source automation tool that allows users to automate IT tasks such as configuration management, application deployment, and orchestration. It is widely used in the DevOps community for its simplicity and flexibility. However, a vulnerability has been discovered in Ansible that could potentially expose passwords entered during password prompts.
Vulnerability Detail
The vulnerability (CVE-2019-14856) in Ansible arises from a data disclosure flaw. When using the ansible-playbook and ansible-cli tools, passwords with special characters are not properly wrapped, leading to their exposure. If a password contains special characters, it will be exposed starting from the first special character. This flaw could compromise the confidentiality of sensitive data. It is important to note that this vulnerability is an incomplete fix for a previous vulnerability (CVE-2019-10206).
How To Fix
Latest published version: 14.5.0 as of 22 Oct 2026
pip install --upgrade "ansible==14.5.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 2.6.0, < 2.6.202.6.20pip install --upgrade "ansible==2.6.20" -
>= 2.7.0, < 2.7.142.7.14pip install --upgrade "ansible==2.7.14" -
>= 2.8.0, < 2.8.62.8.6pip install --upgrade "ansible==2.8.6"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a workaround, users can avoid using passwords with special characters when prompted by Ansible. Instead, it is recommended to use passwords without special characters or consider using other authentication methods that do not involve password prompts.
Conclusion
The Ansible Password Prompts Vulnerability (CVE-2019-14856) exposes passwords with special characters during password prompts. It is crucial to update Ansible to the fixed versions mentioned earlier to mitigate this vulnerability. If you are unable to update, consider using workarounds and alternative authentication methods. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ansible →
FAQ
The vulnerability could expose passwords with special characters, compromising the confidentiality of sensitive data.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your version of Ansible is affected by this vulnerability. Simply provide your Pipfile.lock and it will alert you in real-time.
There are no known exploits for this vulnerability at the moment. However, it is important to apply the recommended fixes to mitigate the risk.
While it is recommended to update to the fixed versions, if you are unable to do so, you can consider using workarounds such as avoiding passwords with special characters or exploring alternative authentication methods.
You can find more information about this vulnerability, including the complete advisory, on the GitHub Advisory Database: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-6fq2-x65v-v9h7/GHSA-6fq2-x65v-v9h7.json
References
Related vulnerabilities
Recent vulnerabilities recorded for ansible.
