What’s Vulnerable › Vulnerabilities

CVE-2024-8775: Ansible-core: exposure of sensitive information in ansible vault files due to improper logging

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-09-14 · updated 2026-09-17
• Weakness: CWE-532

Description

A flaw was found in Ansible, where sensitive information stored in Ansible Vault files can be exposed in plaintext during the execution of a playbook. This occurs when using tasks such as include_vars to load vaulted variables without setting the no_log: true parameter, resulting in sensitive data being printed in the playbook output or logs. This can lead to the unintentional disclosure of secrets like passwords or API keys, compromising security and potentially allowing unauthorized access or actions.

Affected products

• Red Hat Ansible Automation Platform Execution Environments: all versions — fixed in 1.2.0-91, 2.12.10-54, 2.15.12-17, 2.9.27-32, 3.0.1-95
• Red Hat Discovery 1 for RHEL 9: all versions — fixed in 1.12.0-1
• Red Hat Ansible Automation Platform 2.4 for RHEL 8: all versions — fixed in 1:2.15.13-1.el8ap
• Red Hat Ansible Automation Platform 2.4 for RHEL 9: all versions — fixed in 1:2.15.13-1.el9ap
• Red Hat Ansible Automation Platform 2.5 for RHEL 8: all versions — fixed in 1:2.16.13-1.el8ap
• Red Hat Ansible Automation Platform 2.5 for RHEL 9: all versions — fixed in 1:2.16.13-1.el9ap
• Red Hat Enterprise Linux 10: all versions
• Red Hat Enterprise Linux 8: all versions
• Red Hat Enterprise Linux AI (RHEL AI): all versions

How to fix

Upgrade to a fixed version: Red Hat Ansible Automation Platform Execution Environments 1.2.0-91, 2.12.10-54, 2.15.12-17, 2.9.27-32; Red Hat Discovery 1 for RHEL 9 1.12.0-1; Red Hat Ansible Automation Platform 2.4 for RHEL 8 1:2.15.13-1.el8ap; Red Hat Ansible Automation Platform 2.4 for RHEL 9 1:2.15.13-1.el9ap; Red Hat Ansible Automation Platform 2.5 for RHEL 8 1:2.16.13-1.el8ap; Red Hat Ansible Automation Platform 2.5 for RHEL 9 1:2.16.13-1.el9ap. Check the vendor advisory for mitigations.

References

• https://access.redhat.com/errata/RHSA-2024:10762
• https://access.redhat.com/errata/RHSA-2024:8969
• https://access.redhat.com/errata/RHSA-2024:9894
• https://access.redhat.com/errata/RHSA-2025:1249
• https://access.redhat.com/security/cve/CVE-2024-8775
• https://bugzilla.redhat.com/show_bug.cgi?id=2312119
• https://github.com/advisories/GHSA-jpxc-vmjf-9fcj
• https://lists.debian.org/debian-lts-announce/2024/11/msg00021.html

Get alerted when CVE-2024-8775 or the next vulnerability affects your stack