PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-14010 ansible-collections CVE debrief

CVE-2025-14010 is an information disclosure issue in ansible-collection-community-general. When Ansible is run with verbose or debug output, plaintext passwords can be written to logs, which can then expose sensitive credentials to anyone with log access. The impact is confidentiality-focused and may include compromise of Keycloak accounts or administrative access if exposed secrets are reused.

Vendor
ansible-collections
Product
community.general
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2025-12-04
Original CVE updated
2026-05-20
Advisory published
2025-12-04
Advisory updated
2026-05-20

Who should care

Teams running Ansible automation that uses community.general, especially environments that enable verbose or debug logging, centralize Ansible output into shared log systems, or use the collection for Keycloak-related administration. Security and platform teams that retain or forward job logs should also treat this as relevant.

Technical summary

According to the supplied NVD data, CVE-2025-14010 affects redhat/community.general and results in sensitive credentials being exposed in verbose output during Ansible debug modes. The NVD CVSS vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, indicating a local, low-privilege path with high confidentiality impact and no direct integrity or availability impact. The weakness is mapped to CWE-532, which covers information exposure through log files.

Defensive priority

Medium. Prioritize faster remediation if debug logging is enabled in production, if logs are broadly accessible, or if the affected automation handles administrative credentials.

Recommended defensive actions

  • Review Ansible playbooks, roles, and CI/CD jobs that use community.general and reduce or disable verbose/debug output where possible.
  • Restrict access to Ansible job logs, aggregators, and archives; treat historical logs as potentially sensitive.
  • Rotate any credentials that may have been exposed in logs, including passwords used for Keycloak or administrative automation.
  • Apply the vendor or upstream fix referenced in the Red Hat advisory, the upstream GitHub issue, pull request, and security-fixes changelog entry.
  • After remediation, re-run affected automation with logging controls in place and verify that secrets are no longer emitted to output.

Evidence notes

The assessment is based on the supplied NVD record and its referenced official/vendor sources. The CVE description says the flaw can expose plaintext passwords through verbose output when Ansible runs in debug modes, and the weakness is identified as CWE-532. The record was published on 2025-12-04 and modified on 2026-05-20. No KEV entry is present in the provided data.

Official resources

Publicly disclosed in the supplied CVE/NVD data on 2025-12-04. The NVD record was last modified on 2026-05-20. No Known Exploited Vulnerabilities entry is listed in the provided corpus.