Is CVE-2025-14010 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-14010 being exploited in the wild.

How severe is CVE-2025-14010?

Medium severity, with a CVSS score of 5.5, published 4 December 2025.

Which products and versions are affected?

Ansible Community.General Collection Versions prior to 10.1.0 and 11.1.0; ansible (PyPI) ECOSYSTEM:introduced=0,fixed=12.2.0.

Is there a fix for CVE-2025-14010?

Yes. ansible (PyPI): upgrade to 12.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-14010 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2025-14010?

Check whether you run Ansible Community.General Collection, ansible (PyPI) or Redhat Community.General at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-14010: Ansible community.general information exposure in Keycloak user module

CVE-2025-14010 · Severity: medium · CVSS 5.5 · Published 2025-12-04

A security flaw was found in the Ansible 'community.general' collection, specifically within the module used to manage Keycloak users. When Ansible is run in debug or verbose mode, the system may record sensitive plaintext passwords in log files or console output. An attacker with access to these logs could use the exposed credentials to gain unauthorized access to Keycloak accounts or administrative interfaces.

Technologies: Ansible Community.General Collection, ansible (PyPI). Vendors: Ansible, PyPI, Redhat.

Quick answers

Is CVE-2025-14010 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-14010 being exploited in the wild.
How severe is CVE-2025-14010?: Medium severity, with a CVSS score of 5.5, published 4 December 2025.
Which products and versions are affected?: Ansible Community.General Collection Versions prior to 10.1.0 and 11.1.0; ansible (PyPI) ECOSYSTEM:introduced=0,fixed=12.2.0.
Is there a fix for CVE-2025-14010?: Yes. ansible (PyPI): upgrade to 12.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-14010 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2025-14010?: Check whether you run Ansible Community.General Collection, ansible (PyPI) or Redhat Community.General at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

ansible (PyPI): upgrade to 12.2.0 or later
```
pip install "ansible>=12.2.0"
```

Technical details

The vulnerability is classified as an insertion of sensitive information into log files (CWE-532). It resides in the 'community.general.keycloak_user' module, where the 'credentials[].value' field was not marked with 'no_log=True'. When a user executes Ansible playbooks using this module with verbose flags (e.g., -vvv), the module's return data includes plaintext passwords in the output. A local attacker or any user with read access to the execution logs can retrieve these credentials. The issue has been addressed by marking the sensitive field as 'no_log' in the module's argument specification.

Affected products

Ansible community.general collection Versions prior to 10.1.0 and 11.1.0

Identifiers

CVE-2025-14010
GHSA-8ggh-xwr9-3373
PYSEC-2026-1119

Timeline

2025-10-28: patched: Fix submitted to the community.general repository
2025-12-04: disclosed: Initial disclosure and CVE assignment
2025-12-04: advisory: Red Hat published security advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.