CVE-2025-7738CWE-312

Python3.11-django-ansible-base: sensitive authenticator secrets returned in clear text via api in aap

Medium · published July 31, 2025

CVSS v3.1
4.4
EPSS
0%
Percentile
13.9
In the wild
Unconfirmed
What it is

A flaw was found in Ansible Automation Platform (AAP) where the Gateway API returns the client secret for certain GitHub Enterprise authenticators in clear text. This vulnerability affects administrators or auditors accessing authenticator configurations. While access is limited to privileged users, the clear text exposure of sensitive credentials increases the risk of accidental leaks or misuse.

The record
Technical detail
CVSS v3.1
4.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00237 · 13.9th percentile
Weakness
CWE-312 · Cleartext Storage of Sensitive Information
Published
2025-07-31T14:12Z
EPSS history
Timeline
  • 31 JUL 14:12Z
    Python3.11-django-ansible-base: sensitive authenticator secrets returned in clear text via api in aap
    cvelistv5