Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2019-14858

20
FAUCET Score

CVE-2019-14858 is a medium-severity information disclosure vulnerability affecting Ansible Engine versions 2.x up to 2.8 and Ansible Tower versions 3.x up to 3.5. When an Ansible module fails due to an invalid parameter, sensitive data within sub-parameters marked as 'no_log' can be inadvertently exposed in verbose logs, bypassing intended masking. This local vulnerability (CVSS 5.5) requires low privileges and local access, potentially leading to the compromise of confidential information. There is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.

Impacted Technologies

VendorProductVersion(s)CPE
>= 2.0, <= 2.8.0CPE matchmatch criteria
cpe:2.3:a:redhat:ansible_engine:*:*:*:*:*:*:*:*
>= 3.0, <= 3.5.0CPE matchmatch criteria
cpe:2.3:a:redhat:ansible_tower:*:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.0

7.3HIGH

CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
Exploitability Score
1.3
Impact Score
5.9
CvssVersion
3.0

Exploit Intelligence

EPSS Score
0.42%
Probability of exploitation in next 30 days
EPSS Percentile
34.4%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
This CVE's current EPSS score of 0.0042 is in the 89th percentile among its peer group of 15,940 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (16)

pippatch availablevia ghsa
Product: ansibleFixed in: 2.9.0rc4
pippatch availablevia ghsa
Product: ansibleFixed in: 2.8.6
pippatch availablevia ghsa
Product: ansibleFixed in: 2.7.14
pippatch availablevia ghsa
Product: ansibleFixed in: 2.6.20
redhatpatch availablevia redhat_api
Product: Red Hat Ansible Engine 2.6 for RHEL 7Fixed in: ansible-0:2.6.20-1.el7ae
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Ansible Engine 2.7 for RHEL 7Fixed in: ansible-0:2.7.14-1.el7ae
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Ansible Engine 2.8 for RHEL 7Fixed in: ansible-0:2.8.6-1.el7ae
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Ansible Engine 2.8 for RHEL 8Fixed in: ansible-0:2.8.6-1.el8ae
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Ansible Engine 2 for RHEL 7Fixed in: ansible-0:2.8.6-1.el7ae
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Ansible Engine 2 for RHEL 8Fixed in: ansible-0:2.8.6-1.el8ae
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenStack Platform 13.0 (Queens)Fixed in: ansible-0:2.6.20-1.el7ae
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenStack Platform 13.0 (Queens) for RHEL 7.6 EUSFixed in: ansible-0:2.6.20-1.el7ae
View patch
redhatno patchvia redhat_api
Product: Red Hat Ansible Tower 3Fixed in: ansible
redhatend of lifevia redhat_api
Product: Red Hat Ceph Storage 3Fixed in: ansible
redhatend of lifevia redhat_api
Product: Red Hat OpenStack Platform 10 (Newton)Fixed in: ansible
redhatend of lifevia redhat_api
Product: Red Hat Storage 3Fixed in: ansible

Vendor Advisories (2)

pipGHSA-h653-95qw-h2mpmedium

Ansible leaks sensitive information to logs when told not to

May 24, 2022
redhatCVE-2019-14858Moderate

ansible: sub parameters marked as no_log are not masked in certain failure scenarios

Oct 11, 2019

References

lists.opensuse.org / opensuse-security-announce/2020-04/msg00021.html
lists.opensuse.org / opensuse-security-announce/2020-04/msg00026.html
access.redhat.com / errata/RHSA-2019:3201
access.redhat.com / errata/RHSA-2019:3202
access.redhat.com / errata/RHSA-2019:3203
access.redhat.com / errata/RHSA-2019:3207
access.redhat.com / errata/RHSA-2020:0756
bugzilla.redhat.com / show_bug.cgi
Issue TrackingThird Party Advisory