VYPR
Medium severity4.2NVD Advisory· Published Nov 29, 2018· Updated Jun 17, 2026

CVE-2018-16859

CVE-2018-16859

Description

Execution of Ansible playbooks on Windows platforms with PowerShell ScriptBlock logging and Module logging enabled can allow for 'become' passwords to appear in EventLogs in plaintext. A local user with administrator privileges on the machine can view these logs and discover the plaintext password. Ansible Engine 2.8 and older are believed to be vulnerable.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
ansiblePyPI
>= 2.7.0a1, < 2.7.32.7.3
ansiblePyPI
< 2.5.122.5.12
ansiblePyPI
>= 2.6.0a1, < 2.6.92.6.9

Affected products

150

Patches

Vulnerability mechanics

References

18

News mentions

0

No linked articles in our index yet.