CVE-2025-14010CWE-532

CVE-2025-14010

Medium · published December 4, 2025

CVSS v3.1
5.5
EPSS
0%
Percentile
7.8
In the wild
Unconfirmed
What it is

A flaw was found in ansible-collection-community-general. This vulnerability allows for information exposure (IE) of sensitive credentials, specifically plaintext passwords, via verbose output when running Ansible with debug modes. Attackers with access to logs could retrieve these secrets and potentially compromise Keycloak accounts or administrative access.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00186 · 7.8th percentile
Weakness
CWE-532 · Insertion of Sensitive Information into Log File
Published
2025-12-04T15:16Z
Affected products (1)
ProductVersionsFixed in
redhat/community.generalall versions—
References (6)
https://access.redhat.com/security/cve/CVE-2025-14010 · [email protected]https://bugzilla.redhat.com/show_bug.cgi?id=2418774 · [email protected]https://github.com/ansible-collections/community.general/issues/11000 · [email protected]https://github.com/ansible-collections/community.general/pull/11005 · [email protected]https://github.com/ansible-community/ansible-build-data/blob/main/12/CHANGELOG-v12.md#security-fixes · [email protected]https://github.com/ansible-collections/community.general/issues/11000 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 04 DEC 09:51Z
    Ansible-collection-community-general: ansible-collection-community-general: keycloak user module leaks credentials in verbose output
    cvelistv5