CVE-2025-14010

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-14010", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2025-12-04T09:30:09.669Z", "datePublished": "2025-12-04T09:51:55.868Z", "dateUpdated": "2026-05-20T13:11:17.109Z"}, "containers": {"cna": {"title": "Ansible-collection-community-general: ansible-collection-community-general: keycloak user module leaks credentials in verbose output", "metrics": [{"other": {"content": {"value": "Moderate", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "A flaw was found in ansible-collection-community-general. This vulnerability allows for information exposure (IE) of sensitive credentials, specifically plaintext passwords, via verbose output when running Ansible with debug modes. Attackers with access to logs could retrieve these secrets and potentially compromise Keycloak accounts or administrative access."}], "affected": [{"vendor": "ansible-collections", "product": "Ansible Community General Collection", "versions": [{"status": "affected", "version": "7.1.0", "lessThan": "9.5.13", "versionType": "semver"}, {"status": "affected", "version": "10.0.0", "lessThan": "10.7.6", "versionType": "semver"}, {"status": "affected", "version": "11.0.0", "lessThan": "11.4.1", "versionType": "semver"}, {"status": "affected", "version": "12.0.0", "lessThan": "12.2.0", "versionType": "semver"}], "packageName": "ansible-collection-community-general", "collectionURL": "https://github.com/ansible-collections/community.general", "defaultStatus": "unaffected"}, {"vendor": "Red Hat", "product": "Red Hat Ceph Storage 5", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-collection-community-general", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:ceph_storage:5"]}, {"vendor": "Red Hat", "product": "Red Hat Ceph Storage 6", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-collection-community-general", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:ceph_storage:6"]}, {"vendor": "Red Hat", "product": "Red Hat Ceph Storage 7", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-collection-community-general", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:ceph_storage:7"]}, {"vendor": "Red Hat", "product": "Red Hat Ceph Storage 8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-collection-community-general", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:ceph_storage:8"]}, {"vendor": "Red Hat", "product": "Red Hat OpenStack Platform 17.1", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-collection-community-general", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:openstack:17.1"]}, {"vendor": "Red Hat", "product": "Red Hat OpenStack Platform 18.0", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-collection-community-general", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:openstack:18.0"]}], "references": [{"url": "https://access.redhat.com/security/cve/CVE-2025-14010", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418774", "name": "RHBZ#2418774", "tags": ["issue-tracking", "x_refsource_REDHAT"]}, {"url": "https://github.com/ansible-collections/community.general/issues/11000"}, {"url": "https://github.com/ansible-collections/community.general/pull/11005"}, {"url": "https://github.com/ansible-community/ansible-build-data/blob/main/12/CHANGELOG-v12.md#security-fixes"}], "datePublic": "2025-12-04T00:00:00.000Z", "workarounds": [{"lang": "en", "value": "Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}], "timeline": [{"lang": "en", "time": "2025-12-04T09:28:27.098Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2025-12-04T00:00:00.000Z", "value": "Made public."}], "credits": [{"lang": "en", "value": "Red Hat would like to thank Chris Conway for reporting this issue."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-05-06T16:49:09.459Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-532", "lang": "en", "description": "CWE-532 Insertion of Sensitive Information into Log File"}]}], "references": [{"url": "https://github.com/ansible-collections/community.general/issues/11000", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-20T13:11:04.005176Z", "id": "CVE-2025-14010", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-20T13:11:17.109Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-14010", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-20T13:11:04.005176Z"}}}], "references": [{"url": "https://github.com/ansible-collections/community.general/issues/11000", "tags": ["exploit"]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-532", "description": "CWE-532 Insertion of Sensitive Information into Log File"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-05T17:22:56.623Z"}}], "cna": {"title": "Ansible-collection-community-general: ansible-collection-community-general: keycloak user module leaks credentials in verbose output", "credits": [{"lang": "en", "value": "Red Hat would like to thank Chris Conway for reporting this issue."}], "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Moderate", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "ansible-collections", "product": "Ansible Community General Collection", "versions": [{"status": "affected", "version": "7.1.0", "lessThan": "9.5.13", "versionType": "semver"}, {"status": "affected", "version": "10.0.0", "lessThan": "10.7.6", "versionType": "semver"}, {"status": "affected", "version": "11.0.0", "lessThan": "11.4.1", "versionType": "semver"}, {"status": "affected", "version": "12.0.0", "lessThan": "12.2.0", "versionType": "semver"}], "packageName": "ansible-collection-community-general", "collectionURL": "https://github.com/ansible-collections/community.general", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:ceph_storage:5"], "vendor": "Red Hat", "product": "Red Hat Ceph Storage 5", "packageName": "ansible-collection-community-general", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:ceph_storage:6"], "vendor": "Red Hat", "product": "Red Hat Ceph Storage 6", "packageName": "ansible-collection-community-general", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:ceph_storage:7"], "vendor": "Red Hat", "product": "Red Hat Ceph Storage 7", "packageName": "ansible-collection-community-general", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:ceph_storage:8"], "vendor": "Red Hat", "product": "Red Hat Ceph Storage 8", "packageName": "ansible-collection-community-general", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openstack:17.1"], "vendor": "Red Hat", "product": "Red Hat OpenStack Platform 17.1", "packageName": "ansible-collection-community-general", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openstack:18.0"], "vendor": "Red Hat", "product": "Red Hat OpenStack Platform 18.0", "packageName": "ansible-collection-community-general", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}], "timeline": [{"lang": "en", "time": "2025-12-04T09:28:27.098Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2025-12-04T00:00:00.000Z", "value": "Made public."}], "datePublic": "2025-12-04T00:00:00.000Z", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2025-14010", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418774", "name": "RHBZ#2418774", "tags": ["issue-tracking", "x_refsource_REDHAT"]}, {"url": "https://github.com/ansible-collections/community.general/issues/11000"}, {"url": "https://github.com/ansible-collections/community.general/pull/11005"}, {"url": "https://github.com/ansible-community/ansible-build-data/blob/main/12/CHANGELOG-v12.md#security-fixes"}], "workarounds": [{"lang": "en", "value": "Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "A flaw was found in ansible-collection-community-general. This vulnerability allows for information exposure (IE) of sensitive credentials, specifically plaintext passwords, via verbose output when running Ansible with debug modes. Attackers with access to logs could retrieve these secrets and potentially compromise Keycloak accounts or administrative access."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-05-06T16:49:09.459Z"}}}, "cveMetadata": {"cveId": "CVE-2025-14010", "state": "PUBLISHED", "dateUpdated": "2026-05-20T13:11:17.109Z", "dateReserved": "2025-12-04T09:30:09.669Z", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "datePublished": "2025-12-04T09:51:55.868Z", "assignerShortName": "redhat"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://github.com/ansible-collections/community.general", "defaultStatus": "unaffected", "packageName": "ansible-collection-community-general", "product": "Ansible Community General Collection", "vendor": "ansible-collections", "versions": [{"lessThan": "9.5.13", "status": "affected", "version": "7.1.0", "versionType": "semver"}, {"lessThan": "10.7.6", "status": "affected", "version": "10.0.0", "versionType": "semver"}, {"lessThan": "11.4.1", "status": "affected", "version": "11.0.0", "versionType": "semver"}, {"lessThan": "12.2.0", "status": "affected", "version": "12.0.0", "versionType": "semver"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:ceph_storage:5"], "defaultStatus": "affected", "packageName": "ansible-collection-community-general", "product": "Red Hat Ceph Storage 5", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:ceph_storage:6"], "defaultStatus": "affected", "packageName": "ansible-collection-community-general", "product": "Red Hat Ceph Storage 6", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:ceph_storage:7"], "defaultStatus": "affected", "packageName": "ansible-collection-community-general", "product": "Red Hat Ceph Storage 7", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:ceph_storage:8"], "defaultStatus": "affected", "packageName": "ansible-collection-community-general", "product": "Red Hat Ceph Storage 8", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openstack:17.1"], "defaultStatus": "affected", "packageName": "ansible-collection-community-general", "product": "Red Hat OpenStack Platform 17.1", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openstack:18.0"], "defaultStatus": "affected", "packageName": "ansible-collection-community-general", "product": "Red Hat OpenStack Platform 18.0", "vendor": "Red Hat"}], "source": "secalert@redhat.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:redhat:community.general:-:*:*:*:*:*:*:*", "matchCriteriaId": "FFB54908-462D-4CE6-9AB2-56997B0EFB79", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw was found in ansible-collection-community-general. This vulnerability allows for information exposure (IE) of sensitive credentials, specifically plaintext passwords, via verbose output when running Ansible with debug modes. Attackers with access to logs could retrieve these secrets and potentially compromise Keycloak accounts or administrative access."}, {"lang": "es", "value": "Se encontr\u00f3 una falla en ansible-collection-community-general. Esta vulnerabilidad permite la exposici\u00f3n de informaci\u00f3n (IE) de credenciales sensibles, espec\u00edficamente contrase\u00f1as en texto plano, mediante la salida detallada al ejecutar Ansible con modos de depuraci\u00f3n. Atacantes con acceso a los registros podr\u00edan recuperar estos secretos y potencialmente comprometer cuentas de Keycloak o el acceso administrativo."}], "id": "CVE-2025-14010", "lastModified": "2026-10-18T17:10:00.110", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "secalert@redhat.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-14010", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-20T13:11:04.005176Z", "version": "2.0.3"}}]}, "published": "2025-12-04T10:16:00.810", "references": [{"source": "secalert@redhat.com", "tags": ["Vendor Advisory"], "url": "https://access.redhat.com/security/cve/CVE-2025-14010"}, {"source": "secalert@redhat.com", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418774"}, {"source": "secalert@redhat.com", "url": "https://github.com/ansible-collections/community.general/issues/11000"}, {"source": "secalert@redhat.com", "url": "https://github.com/ansible-collections/community.general/pull/11005"}, {"source": "secalert@redhat.com", "url": "https://github.com/ansible-community/ansible-build-data/blob/main/12/CHANGELOG-v12.md#security-fixes"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/ansible-collections/community.general/issues/11000"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-532"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"acknowledgement": "Red Hat would like to thank Chris Conway for reporting this issue.", "bugzilla": {"description": "ansible-collection-community-general: ansible-collection-community-general: Keycloak user module leaks credentials in verbose output", "id": "2418774", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418774"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "status": "draft"}, "details": ["A flaw was found in ansible-collection-community-general. This vulnerability allows for information exposure (IE) of sensitive credentials, specifically plaintext passwords, via verbose output when running Ansible with debug modes. Attackers with access to logs could retrieve these secrets and potentially compromise Keycloak accounts or administrative access."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2025-14010", "package_state": [{"cpe": "cpe:/a:redhat:ceph_storage:5", "fix_state": "Fix deferred", "package_name": "ansible-collection-community-general", "product_name": "Red Hat Ceph Storage 5"}, {"cpe": "cpe:/a:redhat:ceph_storage:6", "fix_state": "Fix deferred", "package_name": "ansible-collection-community-general", "product_name": "Red Hat Ceph Storage 6"}, {"cpe": "cpe:/a:redhat:ceph_storage:7", "fix_state": "Fix deferred", "package_name": "ansible-collection-community-general", "product_name": "Red Hat Ceph Storage 7"}, {"cpe": "cpe:/a:redhat:ceph_storage:8", "fix_state": "Fix deferred", "package_name": "ansible-collection-community-general", "product_name": "Red Hat Ceph Storage 8"}, {"cpe": "cpe:/a:redhat:openstack:17.1", "fix_state": "Fix deferred", "package_name": "ansible-collection-community-general", "product_name": "Red Hat OpenStack Platform 17.1"}, {"cpe": "cpe:/a:redhat:openstack:18.0", "fix_state": "Fix deferred", "package_name": "ansible-collection-community-general", "product_name": "Red Hat OpenStack Platform 18.0"}], "public_date": "2025-12-04T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-14010\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-14010"], "statement": "The Red Hat Product Security team would assess the severity of this vulnerability as Moderate, given that exploitation requires access to logs or debug output but nevertheless exposes sensitive credentials. The root cause is the lack of proper output suppression (no_log=True) for the password-containing credentials[].value structure, allowing plaintext passwords to appear in logs and increasing the risk of account compromise in environments where logs are stored, shared, or aggregated.", "threat_severity": "Moderate"}

{}