Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2018-10855

21
FAUCET Score

CVE-2018-10855 describes a vulnerability in Ansible versions 2.5 prior to 2.5.5 and 2.4 prior to 2.4.5, affecting Canonical, Debian, and Red Hat distributions. This flaw causes sensitive data, intended to be hidden by the no_log flag, to be exposed in logs and on the terminal if a task fails. With a CVSS score of 5.9 (Medium), the vulnerability has a network attack vector and high attack complexity, potentially leading to a high impact on confidentiality. There is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.

Impacted Technologies

VendorProductVersion(s)CPE
>= 2.4, < 2.4.5CPE matchmatch criteria
cpe:2.3:a:redhat:ansible_engine:*:*:*:*:*:*:*:*
> 2.5, <= 2.5.5CPE matchmatch criteria
cpe:2.3:a:redhat:ansible_engine:*:*:*:*:*:*:*:*
2.0CPE matchmatch criteria
cpe:2.3:a:redhat:ansible_engine:2.0:*:*:*:*:*:*:*
4.6CPE matchmatch criteria
cpe:2.3:a:redhat:cloudforms:4.6:*:*:*:*:*:*:*
13CPE matchmatch criteria
cpe:2.3:a:redhat:openstack:13:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.0

5.9MEDIUM

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
Exploitability Score
2.2
Impact Score
3.6
CvssVersion
3.0

Exploit Intelligence

EPSS Score
3.09%
Probability of exploitation in next 30 days
EPSS Percentile
86.3%
Percentile rank of EPSS score among Peer Group
As of 2026-07-28
Model: v2026.06.15
This CVE's current EPSS score of 0.0309 is in the 80th percentile among its peer group of 19,958 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (25)

pippatch availablevia ghsa
Product: ansibleFixed in: 2.5.5
pippatch availablevia ghsa
Product: ansibleFixed in: 2.4.5.0
redhatpatch availablevia redhat_api
Product: CloudForms Management Engine 5.9Fixed in: ansible-tower-0:3.2.5-1.el7at
View patch
redhatpatch availablevia redhat_api
Product: CloudForms Management Engine 5.9Fixed in: cfme-0:5.9.3.4-1.el7cf
View patch
redhatpatch availablevia redhat_api
Product: CloudForms Management Engine 5.9Fixed in: cfme-amazon-smartstate-0:5.9.3.4-1.el7cf
View patch
redhatpatch availablevia redhat_api
Product: CloudForms Management Engine 5.9Fixed in: cfme-appliance-0:5.9.3.4-1.el7cf
View patch
redhatpatch availablevia redhat_api
Product: CloudForms Management Engine 5.9Fixed in: cfme-gemset-0:5.9.3.4-1.el7cf
View patch
redhatpatch availablevia redhat_api
Product: CloudForms Management Engine 5.9Fixed in: httpd-configmap-generator-0:0.2.2-1.1.el7cf
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Ansible Engine 2.4 for RHEL 7Fixed in: ansible-0:2.4.5.0-1.el7ae
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Ansible Engine 2.5 for RHEL 7Fixed in: ansible-0:2.5.5-1.el7ae
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Ansible Engine 2 for RHEL 7Fixed in: ansible-0:2.5.5-1.el7ae
View patch
redhatpatch availablevia redhat_api
Product: CloudForms Management Engine 5.9Fixed in: ansible-0:2.4.5.0-1.el7ae
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenStack Platform 12.0 (Pike)Fixed in: ansible-0:2.4.6.0-1.el7ae
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenStack Platform 12.0 (Pike)Fixed in: ansible-role-redhat-subscription-0:1.0.1-4.el7ost
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenStack Platform 13.0 (Queens)Fixed in: ansible-0:2.4.6.0-1.el7ae
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Virtualization 4 for Red Hat Enterprise Linux 7Fixed in: imgbased-0:1.0.20-0.1.el7ev
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Virtualization 4 for Red Hat Enterprise Linux 7Fixed in: redhat-release-virtualization-host-0:4.2-4.3.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Virtualization 4 for Red Hat Enterprise Linux 7Fixed in: redhat-virtualization-host-0:4.2-20180622.0
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenStack Platform 10.0 (Newton)Fixed in: ansible-0:2.4.6.0-1.el7ae
View patch
redhatvendor investigatingvia nvd_reference
View patch
redhatend of lifevia redhat_api
Product: Red Hat Satellite 6Fixed in: ansible
redhatend of lifevia redhat_api
Product: Red Hat Storage 3Fixed in: ansible
redhatend of lifevia redhat_api
Product: Red Hat Ceph Storage 2Fixed in: ansible
redhatend of lifevia redhat_api
Product: Red Hat Ceph Storage 3Fixed in: ansible
redhatend of lifevia redhat_api
Product: Red Hat Quickstart Cloud Installer 1Fixed in: ansible

Vendor Advisories (2)

pipGHSA-jwcc-j78w-j73whigh

Ansible exposes sensitive data in log files and on the terminal

Oct 10, 2018
redhatCVE-2018-10855Moderate

ansible: Failed tasks do not honour no_log option allowing for secrets to be disclosed in logs

Jun 11, 2018

References

access.redhat.com / errata/RHBA-2018:3788
Vendor Advisory
access.redhat.com / errata/RHSA-2018:1948
Vendor Advisory
access.redhat.com / errata/RHSA-2018:1949
Vendor Advisory
access.redhat.com / errata/RHSA-2018:2022
Vendor Advisory
access.redhat.com / errata/RHSA-2018:2079
Vendor Advisory
access.redhat.com / errata/RHSA-2018:2184
Vendor Advisory
access.redhat.com / errata/RHSA-2018:2585
Vendor Advisory
access.redhat.com / errata/RHSA-2019:0054
Vendor Advisory
bugzilla.redhat.com / show_bug.cgi
Issue TrackingVendor Advisory
usn.ubuntu.com / 4072-1
Third Party Advisory
debian.org / security/2019/dsa-4396
Third Party Advisory