A flaw was found in ansible-collection-community-general. This vulnerability allows for information exposure (IE) of sensitive credentials, specifically plaintext passwords, via verbose output when running Ansible with debug modes. Attackers with access to logs could retrieve these secrets and potentially compromise Keycloak accounts or administrative access.
Fix
Patch, vendor advisory and mitigation references on NVD 2
- https://access.redhat.com/security/cve/CVE-2025-14010 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2418774 Issue Tracking, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 5.5 · redhatNVD modified 2026-10-18 17:10
Affected (CPE criteria) 1
cpe:2.3:a:redhat:community.general:-:*:*:*:*:*:*:*
References 6
- https://access.redhat.com/security/cve/CVE-2025-14010 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2418774 Issue Tracking, Vendor Advisory
- https://github.com/ansible-collections/community.general/issues/11000
- https://github.com/ansible-collections/community.general/pull/11005
- https://github.com/ansible-community/ansible-build-data/blob/main/12/CHANGELOG-v12.md#security-fixes
- https://github.com/ansible-collections/community.general/issues/11000