CVE-2025-7738: Ansible Automation Platform Credential Disclosure

CVE-2025-7738 Overview

A flaw in Red Hat Ansible Automation Platform (AAP) causes the Gateway API to return the client secret for certain GitHub Enterprise authenticators in clear text. The issue affects administrators and auditors who read authenticator configurations through the API. The exposed secret should remain encrypted at rest and masked on retrieval, consistent with the handling of other authenticator credentials. Although access to the endpoint is restricted to privileged users, returning the secret in plain text increases the risk of credential leakage through logs, backups, screen captures, or support bundles. The underlying weakness is classified as [CWE-312] Cleartext Storage of Sensitive Information.

Critical Impact
GitHub Enterprise single sign-on client secrets are returned in clear text through the AAP Gateway API, exposing SSO credentials to anyone with administrator or auditor access.

Affected Products

Red Hat Ansible Automation Platform (Gateway component)
django-ansible-base GitHub Enterprise authenticator plugin
django-ansible-base GitHub Enterprise Organization authenticator plugin

Discovery Timeline

2025-07-31 - CVE-2025-7738 published to the National Vulnerability Database
2025-07-31 - Red Hat released security errata RHSA-2025:12772
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-7738

Vulnerability Analysis

The Ansible Automation Platform Gateway exposes authenticator configuration through its REST API. Each authenticator plugin declares which configuration fields contain secrets through the configuration_encrypted_fields list. Fields in this list are encrypted at rest and masked when returned by the API.

For the GitHub Enterprise and GitHub Enterprise Organization authenticator plugins, the declared field names did not match the actual secret field names used by the plugins. As a result, the Gateway API did not treat the client secrets as sensitive and returned them in clear text to any caller permitted to read authenticator configurations.

Root Cause

The GitHub Enterprise plugin declared ENTERPRISE_SECRET as its encrypted field, and the GitHub Enterprise Organization plugin declared ENTERPRISE_ORG_SECRET. Neither identifier matched the actual configuration key, which is SECRET. Because the encryption and masking logic keys off this declaration, the real secret bypassed both encryption at rest and output masking.

Attack Vector

Exploitation requires an authenticated session with administrator or auditor privileges on the AAP Gateway. A user with that access can issue a standard API request against the authenticator configuration endpoint and receive the GitHub Enterprise SSO client secret in the response body. The secret can then be reused against the configured GitHub Enterprise tenant, or inadvertently leaked through API logs, HAR captures, backups, or support bundles that preserve API responses.

python

# Patched declarations in django-ansible-base
# File: ansible_base/authentication/authenticator_plugins/github_enterprise.py
     logger = logger
     type = "github-enterprise"
     category = "sso"
-    configuration_encrypted_fields = ['ENTERPRISE_SECRET']
+    configuration_encrypted_fields = ['SECRET']

# File: ansible_base/authentication/authenticator_plugins/github_enterprise_org.py
     logger = logger
     type = "github-enterprise-org"
     category = "sso"
-    configuration_encrypted_fields = ['ENTERPRISE_ORG_SECRET']
+    configuration_encrypted_fields = ['SECRET']

Source: GitHub Commit e241ea4d

Detection Methods for CVE-2025-7738

Indicators of Compromise

Gateway API responses from the authenticator configuration endpoints that contain a populated SECRET field in clear text rather than a masked value.
Access log entries showing privileged reads against GitHub Enterprise or GitHub Enterprise Organization authenticator objects.
Unexpected GitHub Enterprise OAuth application activity that correlates in time with AAP administrative API access.

Detection Strategies

Review AAP Gateway access logs for GET requests against authenticator configuration endpoints and correlate them with the identity of the calling administrator or auditor.
Compare API responses before and after applying RHSA-2025:12772 to confirm the SECRET field is masked in the patched build.
Hunt for AAP configuration backups or support bundles stored outside the platform and inspect them for exposed GitHub Enterprise client secrets.

Monitoring Recommendations

Alert on administrator or auditor accounts enumerating multiple authenticator objects in a short time window.
Monitor GitHub Enterprise OAuth application sign-ins for anomalous source IPs or user agents after any suspected exposure.
Track creation and export of AAP support bundles and route those events to a central audit log.

How to Mitigate CVE-2025-7738

Immediate Actions Required

Apply the Red Hat Ansible Automation Platform updates described in RHSA-2025:12772.
Rotate the client secret for every GitHub Enterprise and GitHub Enterprise Organization authenticator configured in AAP.
Review audit logs for prior reads of authenticator configurations and treat any exposed secrets as compromised.
Purge cached API responses, support bundles, and backups that may contain the clear text secret.

Patch Information

The fix is tracked in GitHub Pull Request #773 and merged as GitHub Commit e241ea4d. The patch corrects the configuration_encrypted_fields declaration in both GitHub Enterprise authenticator plugins so that the SECRET field is encrypted at rest and masked on API retrieval. Distribution packages are available through Red Hat Security Errata RHSA-2025:12772 and the corresponding analysis at Red Hat CVE Analysis CVE-2025-7738.

Workarounds

Restrict Gateway API administrator and auditor roles to the minimum number of operators until the patch is deployed.
Disable or remove GitHub Enterprise authenticators that are not actively required for single sign-on.
Block external export of AAP support bundles and configuration dumps that could propagate the clear text secret.

bash

# After patching, verify the SECRET field is masked when reading authenticator config
curl -sS -H "Authorization: Bearer $AAP_TOKEN" \
  https://aap.example.com/api/gateway/v1/authenticators/<id>/ \
  | jq '.configuration.SECRET'
# Expected output on patched systems: "$encrypted$" (or equivalent mask), not the raw secret