CVE & CISA-KEV CatalogNVD
CVE-2025-7738
MEDIUM4.4
CVSS v3
Description
A flaw was found in Ansible Automation Platform (AAP) where the Gateway API returns the client secret for certain GitHub Enterprise authenticators in clear text. This vulnerability affects administrators or auditors accessing authenticator configurations. While access is limited to privileged users, the clear text exposure of sensitive credentials increases the risk of accidental leaks or misuse.
How to fix
Remediation Available
ansible-automation-platform-installerRed Hat / RHEL
Fixed in:0:2.5-16.el8apRHSA-2025:12772
Fixed in:0:2.5-16.el8apRHSA-2025:12772
Fixed in:0:2.5-16.el9apRHSA-2025:12772
Fixed in:0:2.5-16.el9apRHSA-2025:12772
ansible-automation-platform-installerRocky
Fixed in:0:2.5-16.el8apRHSA-2025:12772
Fixed in:0:2.5-16.el8apRHSA-2025:12772
Fixed in:0:2.5-16.el9apRHSA-2025:12772
Fixed in:0:2.5-16.el9apRHSA-2025:12772
automation-controllerRed Hat / RHEL
Fixed in:0:4.6.18-1.el8apRHSA-2025:12772
Fixed in:0:4.6.18-1.el8apRHSA-2025:12772
Fixed in:0:4.6.18-1.el8apRHSA-2025:12772
Fixed in:0:4.6.18-1.el8apRHSA-2025:12772
Fixed in:0:4.6.18-1.el8apRHSA-2025:12772
Fixed in:0:4.6.18-1.el9apRHSA-2025:12772
Fixed in:0:4.6.18-1.el9apRHSA-2025:12772
Fixed in:0:4.6.18-1.el9apRHSA-2025:12772
Fixed in:0:4.6.18-1.el9apRHSA-2025:12772
Fixed in:0:4.6.18-1.el9apRHSA-2025:12772
automation-controllerRocky
Fixed in:0:4.6.18-1.el8apRHSA-2025:12772
Fixed in:0:4.6.18-1.el8apRHSA-2025:12772
Fixed in:0:4.6.18-1.el8apRHSA-2025:12772
Fixed in:0:4.6.18-1.el8apRHSA-2025:12772
Fixed in:0:4.6.18-1.el8apRHSA-2025:12772
Fixed in:0:4.6.18-1.el9apRHSA-2025:12772
Fixed in:0:4.6.18-1.el9apRHSA-2025:12772
Fixed in:0:4.6.18-1.el9apRHSA-2025:12772
Fixed in:0:4.6.18-1.el9apRHSA-2025:12772
Fixed in:0:4.6.18-1.el9apRHSA-2025:12772
automation-controller-cliRocky
Fixed in:0:4.6.18-1.el8apRHSA-2025:12772
Fixed in:0:4.6.18-1.el9apRHSA-2025:12772
automation-controller-cliRed Hat / RHEL
Fixed in:0:4.6.18-1.el8apRHSA-2025:12772
Fixed in:0:4.6.18-1.el9apRHSA-2025:12772
automation-controller-serverRocky
Fixed in:0:4.6.18-1.el8apRHSA-2025:12772
Fixed in:0:4.6.18-1.el9apRHSA-2025:12772
automation-controller-serverRed Hat / RHEL
Fixed in:0:4.6.18-1.el8apRHSA-2025:12772
Fixed in:0:4.6.18-1.el9apRHSA-2025:12772
automation-controller-uiRed Hat / RHEL
Fixed in:0:4.6.18-1.el8apRHSA-2025:12772
Fixed in:0:4.6.18-1.el9apRHSA-2025:12772
automation-controller-uiRocky
Fixed in:0:4.6.18-1.el8apRHSA-2025:12772
Fixed in:0:4.6.18-1.el9apRHSA-2025:12772
automation-controller-venv-towerRocky
Fixed in:0:4.6.18-1.el8apRHSA-2025:12772
Fixed in:0:4.6.18-1.el8apRHSA-2025:12772
Fixed in:0:4.6.18-1.el8apRHSA-2025:12772
Fixed in:0:4.6.18-1.el8apRHSA-2025:12772
Fixed in:0:4.6.18-1.el9apRHSA-2025:12772
Fixed in:0:4.6.18-1.el9apRHSA-2025:12772
Fixed in:0:4.6.18-1.el9apRHSA-2025:12772
Fixed in:0:4.6.18-1.el9apRHSA-2025:12772
automation-controller-venv-towerRed Hat / RHEL
Fixed in:0:4.6.18-1.el8apRHSA-2025:12772
Fixed in:0:4.6.18-1.el8apRHSA-2025:12772
Fixed in:0:4.6.18-1.el8apRHSA-2025:12772
Fixed in:0:4.6.18-1.el8apRHSA-2025:12772
Fixed in:0:4.6.18-1.el9apRHSA-2025:12772
Fixed in:0:4.6.18-1.el9apRHSA-2025:12772
Fixed in:0:4.6.18-1.el9apRHSA-2025:12772
Fixed in:0:4.6.18-1.el9apRHSA-2025:12772
automation-gatewayRocky
Fixed in:0:2.5.20250730-2.el8apRHSA-2025:12772
Fixed in:0:2.5.20250730-2.el8apRHSA-2025:12772
Fixed in:0:2.5.20250730-2.el9apRHSA-2025:12772
Fixed in:0:2.5.20250730-2.el9apRHSA-2025:12772
automation-gatewayRed Hat / RHEL
Fixed in:0:2.5.20250730-2.el8apRHSA-2025:12772
Fixed in:0:2.5.20250730-2.el8apRHSA-2025:12772
Fixed in:0:2.5.20250730-2.el9apRHSA-2025:12772
Fixed in:0:2.5.20250730-2.el9apRHSA-2025:12772
automation-gateway-configRed Hat / RHEL
Fixed in:0:2.5.20250730-2.el8apRHSA-2025:12772
Fixed in:0:2.5.20250730-2.el9apRHSA-2025:12772
automation-gateway-configRocky
Fixed in:0:2.5.20250730-2.el8apRHSA-2025:12772
Fixed in:0:2.5.20250730-2.el9apRHSA-2025:12772
automation-gateway-serverRed Hat / RHEL
Fixed in:0:2.5.20250730-2.el8apRHSA-2025:12772
Fixed in:0:2.5.20250730-2.el9apRHSA-2025:12772
automation-gateway-serverRocky
Fixed in:0:2.5.20250730-2.el8apRHSA-2025:12772
Fixed in:0:2.5.20250730-2.el9apRHSA-2025:12772
automation-hubRocky
Fixed in:0:4.10.6-1.el8apRHSA-2025:12772
Fixed in:0:4.10.6-1.el8apRHSA-2025:12772
Fixed in:0:4.10.6-1.el9apRHSA-2025:12772
Fixed in:0:4.10.6-1.el9apRHSA-2025:12772
automation-hubRed Hat / RHEL
Fixed in:0:4.10.6-1.el8apRHSA-2025:12772
Fixed in:0:4.10.6-1.el8apRHSA-2025:12772
Fixed in:0:4.10.6-1.el9apRHSA-2025:12772
Fixed in:0:4.10.6-1.el9apRHSA-2025:12772
python3.11-django-ansible-baseRocky
Fixed in:0:2.5.20250730-1.el8apRHSA-2025:12772
Fixed in:0:2.5.20250730-1.el8apRHSA-2025:12772
Fixed in:0:2.5.20250730-1.el9apRHSA-2025:12772
Fixed in:0:2.5.20250730-1.el9apRHSA-2025:12772
python3.11-django-ansible-baseRed Hat / RHEL
Fixed in:0:2.5.20250730-1.el8apRHSA-2025:12772
Fixed in:0:2.5.20250730-1.el8apRHSA-2025:12772
Fixed in:0:2.5.20250730-1.el9apRHSA-2025:12772
Fixed in:0:2.5.20250730-1.el9apRHSA-2025:12772
python3.11-django-ansible-base+activitystreamRed Hat / RHEL
Fixed in:0:2.5.20250730-1.el8apRHSA-2025:12772
Fixed in:0:2.5.20250730-1.el9apRHSA-2025:12772
python3.11-django-ansible-base+activitystreamRocky
Fixed in:0:2.5.20250730-1.el8apRHSA-2025:12772
Fixed in:0:2.5.20250730-1.el9apRHSA-2025:12772
python3.11-django-ansible-base+api_documentationRed Hat / RHEL
Fixed in:0:2.5.20250730-1.el8apRHSA-2025:12772
Fixed in:0:2.5.20250730-1.el9apRHSA-2025:12772
python3.11-django-ansible-base+api_documentationRocky
Fixed in:0:2.5.20250730-1.el8apRHSA-2025:12772
Fixed in:0:2.5.20250730-1.el9apRHSA-2025:12772
python3.11-django-ansible-base+authenticationRocky
Fixed in:0:2.5.20250730-1.el8apRHSA-2025:12772
Fixed in:0:2.5.20250730-1.el9apRHSA-2025:12772
python3.11-django-ansible-base+authenticationRed Hat / RHEL
Fixed in:0:2.5.20250730-1.el8apRHSA-2025:12772
Fixed in:0:2.5.20250730-1.el9apRHSA-2025:12772
python3.11-django-ansible-base+channel_authRocky
Fixed in:0:2.5.20250730-1.el8apRHSA-2025:12772
Fixed in:0:2.5.20250730-1.el9apRHSA-2025:12772
python3.11-django-ansible-base+channel_authRed Hat / RHEL
Fixed in:0:2.5.20250730-1.el8apRHSA-2025:12772
Fixed in:0:2.5.20250730-1.el9apRHSA-2025:12772
python3.11-django-ansible-base+feature_flagsRocky
Fixed in:0:2.5.20250730-1.el8apRHSA-2025:12772
Fixed in:0:2.5.20250730-1.el9apRHSA-2025:12772
python3.11-django-ansible-base+feature_flagsRed Hat / RHEL
Fixed in:0:2.5.20250730-1.el8apRHSA-2025:12772
Fixed in:0:2.5.20250730-1.el9apRHSA-2025:12772
python3.11-django-ansible-base+jwt_consumerRocky
Fixed in:0:2.5.20250730-1.el8apRHSA-2025:12772
Fixed in:0:2.5.20250730-1.el9apRHSA-2025:12772
python3.11-django-ansible-base+jwt_consumerRed Hat / RHEL
Fixed in:0:2.5.20250730-1.el8apRHSA-2025:12772
Fixed in:0:2.5.20250730-1.el9apRHSA-2025:12772
python3.11-django-ansible-base+oauth2_providerRed Hat / RHEL
Fixed in:0:2.5.20250730-1.el8apRHSA-2025:12772
Fixed in:0:2.5.20250730-1.el9apRHSA-2025:12772
python3.11-django-ansible-base+oauth2_providerRocky
Fixed in:0:2.5.20250730-1.el8apRHSA-2025:12772
Fixed in:0:2.5.20250730-1.el9apRHSA-2025:12772
python3.11-django-ansible-base+rbacRocky
Fixed in:0:2.5.20250730-1.el8apRHSA-2025:12772
Fixed in:0:2.5.20250730-1.el9apRHSA-2025:12772
python3.11-django-ansible-base+rbacRed Hat / RHEL
Fixed in:0:2.5.20250730-1.el8apRHSA-2025:12772
Fixed in:0:2.5.20250730-1.el9apRHSA-2025:12772
python3.11-django-ansible-base+redis_clientRocky
Fixed in:0:2.5.20250730-1.el8apRHSA-2025:12772
Fixed in:0:2.5.20250730-1.el9apRHSA-2025:12772
python3.11-django-ansible-base+redis_clientRed Hat / RHEL
Fixed in:0:2.5.20250730-1.el8apRHSA-2025:12772
Fixed in:0:2.5.20250730-1.el9apRHSA-2025:12772
python3.11-django-ansible-base+rest_filtersRed Hat / RHEL
Fixed in:0:2.5.20250730-1.el8apRHSA-2025:12772
Fixed in:0:2.5.20250730-1.el9apRHSA-2025:12772
python3.11-django-ansible-base+rest_filtersRocky
Fixed in:0:2.5.20250730-1.el8apRHSA-2025:12772
Fixed in:0:2.5.20250730-1.el9apRHSA-2025:12772
python3.11-galaxy-ngRocky
Fixed in:0:4.10.6-1.el8apRHSA-2025:12772
Fixed in:0:4.10.6-1.el8apRHSA-2025:12772
Fixed in:0:4.10.6-1.el9apRHSA-2025:12772
Fixed in:0:4.10.6-1.el9apRHSA-2025:12772
python3.11-galaxy-ngRed Hat / RHEL
Fixed in:0:4.10.6-1.el8apRHSA-2025:12772
Fixed in:0:4.10.6-1.el8apRHSA-2025:12772
Fixed in:0:4.10.6-1.el9apRHSA-2025:12772
Fixed in:0:4.10.6-1.el9apRHSA-2025:12772
Remediation is compiled from vendor and distribution security advisories. Always confirm against the linked source for your exact version and platform.
CVSS v3 Vector
Exploitability
Attack VectorNetwork
Attack ComplexityHigh
Privileges RequiredHigh
User InteractionNone
ScopeUnchanged
Impact
ConfidentialityHigh
IntegrityNone
AvailabilityNone
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
Exploit Intelligence
0.21%probability of exploitation in 30 days
11thpercentile
Low risk: more likely to be exploited than 11% of all known CVEs.
References
Related Vulnerabilities
Other CWE-312 vulnerabilities, ordered by exploit likelihood. View all
| CVE | Severity | CVSS | EPSS | Exploited | Fix |
|---|---|---|---|---|---|
| CVE-2023-50719 | High | 7.5 | 84% | - | Fix |
| CVE-2022-26148 | Critical | 9.8 | 53% | - | Fix |
| CVE-2020-24577 | High | 7.5 | 19% | - | Fix |
| CVE-2021-27140 | High | 7.5 | 19% | - | - |
| CVE-2021-27176 | High | 7.5 | 19% | - | - |
| CVE-2021-27174 | High | 7.5 | 19% | - | - |
Embed a live status badge for CVE-2025-7738
Markdown
[](https://tridentstack.com/cve/CVE-2025-7738)HTML
<a href="https://tridentstack.com/cve/CVE-2025-7738"><img src="https://tridentstack.com/cve/badge/CVE-2025-7738.svg" alt="CVE-2025-7738"></a>Find and fix vulnerabilities across your fleet
TridentStack Control continuously scans your Windows, macOS, and Linux fleet for known vulnerabilities, prioritizes them by severity and active exploitation, and patches them automatically.
Start freeThis product uses NVD data but is not endorsed or certified by the NVD. EPSS scores courtesy of FIRST.org (https://www.first.org/epss). Source: CISA KEV Catalog. Data as of 2025-12-23.