CVE-2019-14846: Ansible Engine Credential Disclosure
Summary
CVE-2019-14846: Ansible Uses Plugins That Disclose Credentials. Affects ansible across 3 version ranges.
< 2.6.20
>= 2.7.0a1, < 2.7.14
>= 2.8.0a1, < 2.8.6
Fixed in 2.6.20, 2.7.14 or 2.8.6, depending on the release line you run. How to fix ↓
Also tracked for
- ansible-core · PyPI
- ansible · Alpine:v3.10
The same CVE-2019-14846 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ansible is an open-source automation tool that allows users to automate IT tasks such as configuration management, application deployment, and orchestration. It is widely used in the industry for its simplicity and flexibility. Ansible Engine versions up to ansible-engine 2.8.5, ansible-engine 2.7.13, ansible-engine 2.6.19 were affected by a vulnerability that resulted in the disclosure of credentials. This vulnerability occurred due to the DEBUG level logging in Ansible, which could expose credentials if a plugin used a library that logged credentials at the DEBUG level. It is important to note that this flaw did not impact Ansible modules, as they are executed in a separate process.
Vulnerability Detail
The vulnerability in Ansible allowed for the disclosure of credentials when a plugin used a library that logged credentials at the DEBUG level. This means that if a plugin within Ansible logged sensitive information, such as passwords or API keys, at the DEBUG level, those credentials could be exposed in the logs. This could potentially lead to unauthorized access or misuse of the exposed credentials. It is crucial for organizations using affected versions of Ansible to take immediate action to mitigate this vulnerability.
How To Fix
Latest published version: 14.5.0 as of 22 Oct 2026
pip install --upgrade "ansible==14.5.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.6.202.6.20pip install --upgrade "ansible==2.6.20" -
>= 2.7.0a1, < 2.7.142.7.14pip install --upgrade "ansible==2.7.14" -
>= 2.8.0a1, < 2.8.62.8.6pip install --upgrade "ansible==2.8.6"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, as a general best practice, it is advisable to avoid logging sensitive information at the DEBUG level in any plugins or libraries used within Ansible.
Conclusion
The vulnerability in Ansible Engine versions up to ansible-engine 2.8.5, ansible-engine 2.7.13, ansible-engine 2.6.19 could result in the disclosure of credentials if a plugin used a library that logged credentials at the DEBUG level. It is crucial for organizations using affected versions to update to the fixed versions mentioned above to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ansible →
FAQ
Ansible is an open-source automation tool used for configuration management, application deployment, and orchestration.
All Ansible Engine versions up to ansible-engine 2.8.5, ansible-engine 2.7.13, ansible-engine 2.6.19 are affected.
No, Ansible modules are not affected as they are executed in a separate process.
The disclosure of credentials could lead to unauthorized access or misuse of sensitive information, potentially compromising the security of systems and data.
To fix this vulnerability, update Ansible to one of the fixed versions: ansible-engine 2.6.20, ansible-engine 2.7.14, ansible-engine 2.8.6.
References
Related vulnerabilities
Recent vulnerabilities recorded for ansible.
