Vulnerability · Published Jul 31, 2025 · Assigned by redhat
CVE-2025-7738Python3.11-django-ansible-base: sensitive authenticator secrets returned in clear text via api in aap
Medium 4.4
In plain English
A medium-severity security flaw in django-ansible-base from Ansible. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities).
Official description
A flaw was found in Ansible Automation Platform (AAP) where the Gateway API returns the client secret for certain GitHub Enterprise authenticators in clear text. This vulnerability affects administrators or auditors accessing authenticator configurations. While access is limited to privileged users, the clear text exposure of sensitive credentials increases the risk of accidental leaks or misuse.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Ansible | django-ansible-base | 0 – before 2025.7.22 |
| Red Hat | Red Hat Ansible Automation Platform 2.5 for RHEL 8 | see references |
| Red Hat | Red Hat Ansible Automation Platform 2.5 for RHEL 9 | see references |
Weakness: CWE-312 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
References
- RHSA-2025:12772 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2025-7738 vdb-entry, x_refsource_REDHAT
- RHBZ#2381589 issue-tracking, x_refsource_REDHAT
- https://github.com/ansible/django-ansible-base/commit/e241ea4dce8df577eda15301e0a8e61be647b27b
- https://github.com/ansible/django-ansible-base/pull/773