CVE-2025-7738mediumCWE-312

CVE-2025-7738: medium-severity vulnerability in Ansible django-ansible-base

Python3.11-django-ansible-base: sensitive authenticator secrets returned in clear text via api in aap

Published · Updated

Follow this CVE+ Monitor Red Hat Ansible Automation Platform+ Monitor django-ansible-base

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.4epss 0.3%
A flaw was found in Ansible Automation Platform (AAP) where the Gateway API returns the client secret for certain GitHub Enterprise authenticators in clear text. This vulnerability affects administrators or auditors accessing authenticator configurations. While access is limited to privileged users, the clear text exposure of sensitive credentials increases the risk of accidental leaks or misuse.
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
Affected products
Ansible · django-ansible-baseRed Hat · Red Hat Ansible Automation Platform 2.5 for RHEL 8Red Hat · Red Hat Ansible Automation Platform 2.5 for RHEL 9
Related CVEs — Ansible django-ansible-base

In the same product, most dangerous first.

CVE-2026-71364HIGHAwx: project archive extraction allows path traversal file writesEPSS 1.7%CVE-2026-12701CRITICALPulpcore: pulpcore: relative_path_validator bypass via directory traversal in filesystemexportEPSS 1.2%CVE-2026-84474CRITICALAutomation-controller: automation-controller-container: automation-controller: view_jobtemplate to execute privilege escalation via host_config_key exposure and x-forwarded-for spoofing of provisioning-callback host matchEPSS 0.8%CVE-2026-84502CRITICALAutomation-controller: automation-controller-container: automation-controller: project scm_url argument injection into `git ls-remote --upload-pack` yields rce on the controller-task control-plane podEPSS 0.6%CVE-2025-49520HIGHEvent-driven-ansible: authenticated argument injection in git url in eda project creationEPSS 0.6%CVE-2025-49521HIGHEvent-driven-ansible: template injection via git branch and refspec in eda projectsEPSS 0.6%