A vulnerability was found in Ansible Tower before 3.6.1 where an attacker with low privilege could retrieve usernames and passwords credent…

published 2019-11-26 6 y ago modified 2026-06-17 4 mo ago also EUVD-2019-5998

cvss: 8.4; version 3.0, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 14%
public exploits: 0; none known

A vulnerability was found in Ansible Tower before 3.6.1 where an attacker with low privilege could retrieve usernames and passwords credentials from the new RHSM saved in plain text into the database at '/api/v2/config' when applying the Ansible Tower license.

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2019-14890 updated 2026-05-07 cvss 8.4

Tower: RHSM username and password exposed after license application

Red Hat Ansible Tower 3.6 for RHEL 7 ansible-tower-36/ansible-tower 3.6.1-1
fixed: vendor fix “There is no mitigation for this issue since this issue happens when Red Hat license is applied.” RHSA-2019:3958
Red Hat CloudForms Management Engine 5 ansible-tower, ansible-tower-ui, ansible-tower-setup, ansible-tower-server, ansible-tower-venv-tower, ansible-tower-venv-ansible
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.24% chance of exploitation in the next 30 days, higher than 14% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.0	8.4	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
NVD	3.1	8.4	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
NVD	2.0	2.1	AV:L/AC:L/Au:N/C:P/I:N/A:N

Affected products

[UNKNOWN] Tower

Classification

Weakness

CWE-312 Cleartext Storage of Sensitive Information

References

bugzilla.redhat.com /show_bug.cgi?id=CVE-2019-14890
issue-tracking, third-party-advisory

Sources

CVE List CVE-2019-14890
NVD CVE-2019-14890

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary