# CVE-2025-14010: Ansible community.general information exposure in Keycloak user module

Source: https://junglewise.ai/threats/cve-2025-14010-ansible-community-general-information-exposure-in-keycloak-user  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-12-04. Updated: 2026-05-20  
License: CC BY 4.0 with a link back

CVE-2025-14010 · Severity: medium · CVSS 5.5 · Published 2025-12-04

A security flaw was found in the Ansible 'community.general' collection, specifically within the module used to manage Keycloak users. When Ansible is run in debug or verbose mode, the system may record sensitive plaintext passwords in log files or console output. An attacker with access to these logs could use the exposed credentials to gain unauthorized access to Keycloak accounts or administrative interfaces.

Technologies: [Ansible Community.General Collection](https://junglewise.ai/threats/technologies/community-general-collection), [ansible (PyPI)](https://junglewise.ai/threats/technologies/ansible). Vendors: [Ansible](https://junglewise.ai/threats/vendors/ansible), [PyPI](https://junglewise.ai/threats/vendors/pypi), [Redhat](https://junglewise.ai/threats/vendors/redhat).

## Quick answers

**Is CVE-2025-14010 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-14010 being exploited in the wild.

**How severe is CVE-2025-14010?** Medium severity, with a CVSS score of 5.5, published 4 December 2025.

**Which products and versions are affected?** Ansible Community.General Collection Versions prior to 10.1.0 and 11.1.0; ansible (PyPI) ECOSYSTEM:introduced=0,fixed=12.2.0.

**Is there a fix for CVE-2025-14010?** Yes. ansible (PyPI): upgrade to 12.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-14010 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2025-14010?** Check whether you run Ansible Community.General Collection, ansible (PyPI) or Redhat Community.General at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- ansible (PyPI): upgrade to 12.2.0 or later

  ```sh
  pip install "ansible>=12.2.0"
  ```


## Technical details

The vulnerability is classified as an insertion of sensitive information into log files (CWE-532). It resides in the 'community.general.keycloak_user' module, where the 'credentials[].value' field was not marked with 'no_log=True'. When a user executes Ansible playbooks using this module with verbose flags (e.g., -vvv), the module's return data includes plaintext passwords in the output. A local attacker or any user with read access to the execution logs can retrieve these credentials. The issue has been addressed by marking the sensitive field as 'no_log' in the module's argument specification.

## Affected products

- Ansible community.general collection Versions prior to 10.1.0 and 11.1.0

## Identifiers

- CVE-2025-14010
- GHSA-8ggh-xwr9-3373
- PYSEC-2026-1119

## Timeline

- 2025-10-28: patched: Fix submitted to the community.general repository
- 2025-12-04: disclosed: Initial disclosure and CVE assignment
- 2025-12-04: advisory: Red Hat published security advisory

## References

- [https://access.redhat.com/security/cve/CVE-2025-14010](https://access.redhat.com/security/cve/CVE-2025-14010)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2418774](https://bugzilla.redhat.com/show_bug.cgi?id=2418774)
- [https://github.com/ansible-collections/community.general/issues/11000](https://github.com/ansible-collections/community.general/issues/11000)
- [https://github.com/ansible-collections/community.general/pull/11005](https://github.com/ansible-collections/community.general/pull/11005)
- [https://github.com/ansible-community/ansible-build-data/blob/main/12/CHANGELOG-v12.md](https://github.com/ansible-community/ansible-build-data/blob/main/12/CHANGELOG-v12.md)

## Related threats

- [PYSEC-2026-1120 - Ansible symlink attack vulnerability](https://junglewise.ai/threats/cve-2023-5115-ansible-symlink-attack-vulnerability)
- [PYSEC-2026-768 - Ansible leaks password to logs](https://junglewise.ai/threats/cve-2022-3697-ansible-leaks-password-to-logs)
- [PYSEC-2026-618 - Insertion of Sensitive Information into Log File in ansible](https://junglewise.ai/threats/cve-2021-20180-insertion-of-sensitive-information-into-log-file-in-ansible)
- [Ansible discloses sensitive information in traceback error message](https://junglewise.ai/threats/cve-2021-3620-ansible-discloses-sensitive-information-in-traceback-error-message)
- [Ansible template injection and command injection](https://junglewise.ai/threats/cve-2021-3583-ansible-template-injection-and-command-injection)