# CVE-2018-16876: ansible Info Disclosure โ€” Fixed in 2.5.14 ๐Ÿ ๐Ÿ PyPI Not in CISA KEV MEDIUM severity # CVE-2018-16876 โ€” ansible MEDIUM [Fix: ansible/ansible#49569](https://github.com/ansible/ansible/pull/49569) CVE-2018-16876 is a medium-severity (CVSS 5.3) Information Exposure vulnerability in ansible. A fix is available for ansible โ€” see the affected versions and patch details below. Ansible sensitive information disclosure Also known as[GHSA-j569-fghw-f9rx](/vulnerability/GHSA-j569-fghw-f9rx)PYSEC-2019-141 Published Jan 3, 2019 Updated Oct 20, 2026 Affected 3 pkgs Patched 3 / 3 Exploits None indexed Exploitation data as of Nov 5, 2026 ยท OSV.dev, NVD, FIRST.org (EPSS) ## EPSS Exploitation Probability [via FIRST.org โ†—](https://www.first.org/epss/) 2.5%probability of exploitation in next 30 days Lower Risk0.00% Lower risk than most CVEs85th percentile โ€” riskier than 85% of all scored CVEsHighest risk 0.27%1.18%2.09%2.99%0.8%2.5%May 26Sep 26Nov 26 Probability of exploitation in the next 30 days, from [FIRST.org EPSS](https://www.first.org/epss/). ## How urgent is this, really ## Where this sits among everything scored ## Real-World Exposure 3 pkgs affected ๐Ÿ`ansible`๐Ÿ`ansible`๐Ÿ`ansible` Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects PyPI packages โ€” download data is not available via public APIs for these ecosystems. ## Description ansible before versions 2.5.14, 2.6.11, 2.7.5 is vulnerable to a information disclosure flaw in vvv+ mode with no\_log on that can lead to leakage of sensible data. ## Affected Packages 3 total 3 fixed Ecosystem Package Vulnerable range Fix ๐ŸPyPI `ansible` all versions 2.5.14`pip install --upgrade 'ansible==2.5.14'` ๐ŸPyPI `ansible` โ‰ฅ 2.6.0a1&&< 2.6.11 2.6.11`pip install --upgrade 'ansible==2.6.11'` ๐ŸPyPI `ansible` โ‰ฅ 2.7.0a1&&< 2.7.5 2.7.5`pip install --upgrade 'ansible==2.7.5'` ## Affected Products 9 products ยท 16 configurations OS `ubuntu linux`canonical 3 versions 16.0418.0419.04 OS `debian linux`debian 1 version 9.0 Application `ansible`redhat โ‰ฅ 2.7.0 && < 2.7.5 range Application `ansible engine`redhat 4 versions 2.02.52.62.7 OS `enterprise linux desktop`redhat 1 version 7.0 OS `enterprise linux server`redhat 1 version 7.0 ## Detection & mitigation playbook Open-source dependency 1. ### Detect Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for ansible, including transitive dependencies โ€” a direct dependency you never call can still pull in a vulnerable version. 2. ### Fix Update ansible to 2.5.14 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range โ€” O3 confirms CVE-2018-16876 is resolved across your whole dependency graph. 3. ### Workarounds Assume what was exposed is already known: rotate any credential, token or key that the affected component could return, restrict the endpoint to callers that genuinely need it, and strip sensitive fields from responses and error output at the boundary rather than relying on the client not to read them. ## Fixing This On Your OS If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below โ€” it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project. Red HatModerate Product Fixed in Advisory Red Hat Ansible Engine 2.5 for RHEL 7 `ansible-0:2.5.14-1.el7ae` [RHSA-2018:3835](https://access.redhat.com/errata/RHSA-2018:3835) Red Hat Ansible Engine 2.6 for RHEL 7 `ansible-0:2.6.11-1.el7ae` [RHSA-2018:3836](https://access.redhat.com/errata/RHSA-2018:3836) Red Hat Ansible Engine 2.7 for RHEL 7 `ansible-0:2.7.5-1.el7ae` [RHSA-2018:3837](https://access.redhat.com/errata/RHSA-2018:3837) Red Hat Ansible Engine 2 for RHEL 7 `ansible-0:2.7.5-1.el7ae` [RHSA-2018:3838](https://access.redhat.com/errata/RHSA-2018:3838) Red Hat OpenStack Platform 13.0 (Queens) `ansible-0:2.6.11-1.el7ae` [RHSA-2019:0564](https://access.redhat.com/errata/RHSA-2019:0564) Red Hat OpenStack Platform 14.0 (Rocky) `ansible-0:2.6.11-1.el7ae` [RHSA-2019:0590](https://access.redhat.com/errata/RHSA-2019:0590) ## Frequently Asked Questions ansible before versions 2.5.14, 2.6.11, 2.7.5 is vulnerable to a information disclosure flaw in vvv+ mode with no\_log on that can lead to leakage of sensible data. O3 Security ยท Impact-Aware SCA ### Is CVE-2018-16876 in your dependencies? Find it across PyPI, including transitive dependencies. [Scan my dependencies](/book-demo) [How O3 SCA works](/impact-aware-sca)