Description
An information disclosure flaw was found in ansible-core due to a failure to respect the ANSIBLE_NO_LOG configuration in some scenarios. Information is still included in the output in certain tasks, such as loop items. Depending on the task, this issue may include sensitive information, such as decrypted secret values.
Affected products
redhat: ansible; redhat: enterprise linux; redhat: ansible automation platform; redhat: ansible developer; redhat: ansible inside; fedoraproject: fedora
References10
- access.redhat.com/errata/RHSA-2024:0733 Vendor Advisory
- access.redhat.com/security/cve/CVE-2024-0690 Vendor Advisory
- access.redhat.com/errata/RHSA-2024:0733 Vendor Advisory
- access.redhat.com/security/cve/CVE-2024-0690 Vendor Advisory
- github.com/ansible/ansible/pull/82565 Issue TrackingPatch
- github.com/ansible/ansible/pull/82565 Issue TrackingPatch
- access.redhat.com/errata/RHSA-2024:2246
- access.redhat.com/errata/RHSA-2024:3043
- bugzilla.redhat.com/show_bug.cgi?id=2259013 Issue Tracking
- access.redhat.com/errata/RHSA-2024:2246
Metrics
- CVSS 3.1
-
5.5
MEDIUM
Score source: NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - EPSS — exploit probability
- 0% percentile: 23 · as of 5 November 2026
- CWE
- CWE-117CWE-116
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.