CVE-2025-7738: Python3.11-django-ansible-base: sensitive authenticator secrets returned in clear text via api in aap
A flaw was found in Ansible Automation Platform (AAP) where the Gateway API returns the client secret for certain GitHub Enterprise authenticators in clear text. This vulnerability affects administrators or auditors accessing authenticator configurations. While access is limited to privileged users, the clear text exposure of sensitive credentials increases the risk of accidental leaks or misuse.
Other sources
A sensitive information disclosure vulnerability exists in the Gateway API of Ansible Automation Platform. When fetching the configuration of certain authenticators (GitHub Enterprise or GitHub Enterprise Org), the API returns the OAuth2 client secret in clear text instead of redacting or masking it (e.g., returning $encrypted$). This flaw is present in the endpoint /api/gateway/v1/authenticators/<authenticator ID>/ and can be reproduced by administrators or auditors with access. While not directly exploitable over the network by unauthorized actors, it exposes a high-value secret that could be misused if accessed by a malicious insider or compromised privileged account.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-7738?
CVE-2025-7738 is considered a high severity vulnerability due to the exposure of sensitive client secrets.
What components are affected by CVE-2025-7738?
CVE-2025-7738 affects the Gateway API within the Red Hat Ansible Automation Platform.
How do I fix CVE-2025-7738?
To fix CVE-2025-7738, you should update your Ansible Automation Platform to the latest version where the vulnerability has been addressed.
Who is impacted by CVE-2025-7738?
Administrators and auditors accessing authenticator configurations in Ansible Automation Platform are primarily impacted by CVE-2025-7738.
What type of information is exposed in CVE-2025-7738?
CVE-2025-7738 exposes client secrets for certain GitHub Enterprise authenticators in clear text.