CVE-2023-4237 HIGH

CVE-2023-4237: Platform: ec2_key module prints out the private key directly to the standard output

Vendor Red Hat
Product Red Hat Ansible Automation Platform 2.4 for RHEL 8
Weakness CWE-497
Published October 4, 2023
Last update February 25, 2026

CVSS base score

7.3/10
Attack vector Local
Attack complexity Low
Privileges required Low
User interaction Required
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

A flaw was found in the Ansible Automation Platform. When creating a new keypair, the ec2_key module prints out the private key directly to the standard output. This flaw allows an attacker to fetch those keys from the log files, compromising the system's confidentiality, integrity, and availability.

Key dates

02Disclosure timeline

October 4, 2023 CVE published
February 25, 2026 Record updated