Bug 2381589 (CVE-2025-7738)

Summary: CVE-2025-7738 python3.11-django-ansible-base: Sensitive Authenticator Secrets Returned in Clear Text via API in AAP
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: haoli, hkataria, jajackso, jcammara, jmitchel, jneedle, kegrant, koliveir, kshier, mabashia, pbraun, shvarugh, simaishi, smcdonal, stcannon, teagle, tfister, thavo, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Ansible Automation Platform (AAP) where the Gateway API returns the client secret for certain GitHub Enterprise authenticators in clear text. This vulnerability affects administrators or auditors accessing authenticator configurations. While access is limited to privileged users, the clear text exposure of sensitive credentials increases the risk of accidental leaks or misuse.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2025-07-17 05:13:02 UTC 
A sensitive information disclosure vulnerability exists in the Gateway API of Ansible Automation Platform. When fetching the configuration of certain authenticators (GitHub Enterprise or GitHub Enterprise Org), the API returns the OAuth2 client secret in clear text instead of redacting or masking it (e.g., returning $encrypted$). This flaw is present in the endpoint /api/gateway/v1/authenticators/<authenticator ID>/ and can be reproduced by administrators or auditors with access. While not directly exploitable over the network by unauthorized actors, it exposes a high-value secret that could be misused if accessed by a malicious insider or compromised privileged account.
Comment 2 errata-xmlrpc 2025-08-04 18:00:08 UTC 
This issue has been addressed in the following products:

  Red Hat Ansible Automation Platform 2.5 for RHEL 9
  Red Hat Ansible Automation Platform 2.5 for RHEL 8

Via RHSA-2025:12772 https://access.redhat.com/errata/RHSA-2025:12772