Ansible leaks password to logs

🗓️ 07 Jul 2026 10:17:22Reported by Python Packaging AdvisoryType

pypa🔗 github.com👁 3 Views

A flaw in Ansible's Amazon collection leaks passwords to logs via the tower_callback parameter in the ec2_instance module.

Reporter	Title	Published	Views	Family All 42
IBM Security Bulletins	Security Bulletin: Mutiple Vulnerabilties affects IBM Watson Machine Learning Accelerator 3.5.0 for Cloud Pak for Data 4.6.5	8 Feb 202419:05	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to multiple Operator package issues	30 Nov 202318:45	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is affected by multiple vulnerabilities Ansibel Runner.	5 Jul 202320:55	–	ibm
IBM Security Bulletins	Security Bulletin: ICP Match 360 is vulnerable to the following CVEs	5 Jul 202319:13	–	ibm
AstraLinux	Astra Linux – Vulnerability in Ansible	19 Jun 202611:10	–	astralinux
BDU FSTEC	The vulnerability of the amazon.aws.ec2_instance configuration management module in Ansible, related to parameter processing errors, allows an attacker to access sensitive data.	23 Sep 202400:00	–	bdu_fstec
CBLMariner	CVE-2022-3697 affecting package ansible 2.9.27-2	12 Jan 202509:15	–	cbl_mariner
Circl	CVE-2022-3697	28 Oct 202220:29	–	circl
CNNVD	Ansible 安全漏洞	25 Oct 202200:00	–	cnnvd
CVE	CVE-2022-3697	28 Oct 202200:00	–	cve

Vulners

Node

pypi ansibleRange2.5.0–7.0.0

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2022-3697
github	www.github.com/ansible-collections/amazon.aws/pull/1199
github	www.github.com/ansible/ansible/pull/35749
github	www.github.com/ansible-community/ansible-build-data/blob/main/6/CHANGELOG-v6.rst
github	www.github.com/ansible/ansible
lists	www.lists.debian.org/debian-lts-announce/2023/12/msg00018.html
pypi	www.pypi.org/project/ansible
github	www.github.com/advisories/GHSA-cpx3-93w7-457x

07 Jul 2026 11:30Current

6.7Medium risk

Vulners AI Score6.7

CVSS 3.17.5

EPSS0.00712