CVE-2021-20191

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-05-26 · updated 2026-06-17
Weakness: CWE-532

Description

A flaw was found in ansible. Credentials, such as secrets, are being disclosed in console log by default and not protected by no_log feature when using those modules. An attacker can take advantage of this information to steal those credentials. The highest threat from this vulnerability is to data confidentiality. Versions before ansible 2.9.18 are affected.

Affected products

Oracle Virtualization: 4.0
Red Hat Ansible: before 2.8.19; from 2.9.0 before 2.9.18; from 2.10.0 before 2.10.7 — fixed in 2.10.7, 2.8.19, 2.9.18
Tower: 3.0
RedHat Cisco Nx-Os Collection: before 1.4.0 — fixed in 1.4.0
RedHat Community General Collection: before 1.3.6; from 2.0.0 before 2.0.1 — fixed in 1.3.6, 2.0.1
RedHat Community Network Collection: before 1.3.2; from 2.0.0 before 2.0.1 — fixed in 1.3.2, 2.0.1
RedHat Docker Community Collection: before 1.2.2 — fixed in 1.2.2
RedHat Google Cloud Platform Ansible Collection: 1.0.2

How to fix

Upgrade to a fixed version: Red Hat Ansible 2.10.7, 2.8.19, 2.9.18; RedHat Cisco Nx-Os Collection 1.4.0; RedHat Community General Collection 1.3.6, 2.0.1; RedHat Community Network Collection 1.3.2, 2.0.1; RedHat Docker Community Collection 1.2.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-20191 or the next vulnerability affects your stack