Executive brief
A security flaw was found in the Ansible 'community.general' collection, specifically within the module used to manage Keycloak users. When Ansible is run in debug or verbose mode, the system may record sensitive plaintext passwords in log files or console output. An attacker with access to these logs could use the exposed credentials to gain unauthorized access to Keycloak accounts or administrative interfaces.
Technical details
The vulnerability is classified as an insertion of sensitive information into log files (CWE-532). It resides in the 'community.general.keycloak_user' module, where the 'credentials[].value' field was not marked with 'no_log=True'. When a user executes Ansible playbooks using this module with verbose flags (e.g., -vvv), the module's return data includes plaintext passwords in the output. A local attacker or any user with read access to the execution logs can retrieve these credentials. The issue has been addressed by marking the sensitive field as 'no_log' in the module's argument specification.
Affected products
- Ansible community.general collection Versions prior to 10.1.0 and 11.1.0
Timeline
- 2025-10-28: patched: Fix submitted to the community.general repository
- 2025-12-04: disclosed: Initial disclosure and CVE assignment
- 2025-12-04: advisory: Red Hat published security advisory
References
- https://access.redhat.com/security/cve/CVE-2025-14010
- https://bugzilla.redhat.com/show_bug.cgi?id=2418774
- https://github.com/ansible-collections/community.general/issues/11000
- https://github.com/ansible-collections/community.general/pull/11005
- https://github.com/ansible-community/ansible-build-data/blob/main/12/CHANGELOG-v12.md