What’s Vulnerable › Vulnerabilities

CVE-2025-7738: Python3.11-django-ansible-base: sensitive authenticator secrets returned in clear text via api in aap

• Severity: medium (CVSS 4.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-07-31 · updated 2026-06-17
• Weakness: CWE-312

Description

A flaw was found in Ansible Automation Platform (AAP) where the Gateway API returns the client secret for certain GitHub Enterprise authenticators in clear text. This vulnerability affects administrators or auditors accessing authenticator configurations. While access is limited to privileged users, the clear text exposure of sensitive credentials increases the risk of accidental leaks or misuse.

Affected products

• Ansible django-ansible-base: before 2025.7.22 — fixed in 2025.7.22
• Red Hat Ansible Automation Platform 2.5 for RHEL 8: all versions — fixed in 0:2.5.20250730-1.el8ap
• Red Hat Ansible Automation Platform 2.5 for RHEL 9: all versions — fixed in 0:2.5.20250730-1.el9ap

How to fix

Upgrade to a fixed version: Ansible django-ansible-base 2025.7.22; Red Hat Ansible Automation Platform 2.5 for RHEL 8 0:2.5.20250730-1.el8ap; Red Hat Ansible Automation Platform 2.5 for RHEL 9 0:2.5.20250730-1.el9ap. Check the vendor advisory for mitigations.

References

• https://access.redhat.com/errata/RHSA-2025:12772
• https://access.redhat.com/security/cve/CVE-2025-7738
• https://bugzilla.redhat.com/show_bug.cgi?id=2381589
• https://github.com/ansible/django-ansible-base/commit/e241ea4dce8df577eda15301e0a8e61be647b27b
• https://github.com/ansible/django-ansible-base/pull/773

Get alerted when CVE-2025-7738 or the next vulnerability affects your stack