Medium severity · published Jul 31, 2025
CVE-2025-7738
Python3.11-django-ansible-base: sensitive authenticator secrets returned in clear text via api in aap
4.4
CVSS
0.2%
EPSS
No
On KEV
Description
A flaw was found in Ansible Automation Platform (AAP) where the Gateway API returns the client secret for certain GitHub Enterprise authenticators in clear text. This vulnerability affects administrators or auditors accessing authenticator configurations. While access is limited to privileged users, the clear text exposure of sensitive credentials increases the risk of accidental leaks or misuse.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
High
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 15% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RH
Red Hat Ansible Automation Platform 2.5 for RHEL 8 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Ansible Automation Platform 2.5 for RHEL 9 · Red Hat
All versions, or not specified · source: vendor
DJ
django-ansible-base · Ansible
before 2025.7.22 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-7738
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-7738
access.redhat.com
https://access.redhat.com/errata/RHSA-2025:12772
access.redhat.com
https://access.redhat.com/security/cve/CVE-2025-7738
bugzilla.redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2381589
github.com
https://github.com/ansible/django-ansible-base/commit/e241ea4dce8df577eda15301e0a8e61be647b27b
github.com
https://github.com/ansible/django-ansible-base/pull/773