CVE-2021-3681

A flaw was found in Ansible Galaxy Collections. When collections are built manually, any files in the repository directory that are not explicitly excluded via the ``build_ignore`` list in "galaxy.yml" include files in the ``.tar.gz`` file. This contains sensitive info, such as the user's Ansible Galaxy API key and any secrets in ``ansible`` or ``ansible-playbook`` verbose output without the``no_log`` redaction. Currently, there is no way to deprecate a Collection Or delete a Collection Version. Once published, anyone who downloads or installs the collection can view the secrets.

• CWE-522
• CWE-522

• https://bugzilla.redhat.com/show_bug.cgi?id=1989407Issue Tracking, Vendor Advisory
• https://github.com/ansible/galaxy/issues/1977Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1989407Issue Tracking, Vendor Advisory
• https://github.com/ansible/galaxy/issues/1977Third Party Advisory

Published

Apr 18, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-36804Akaunting version 2.1.12 and earlier suffers from a password…8.1
• CVE-2021-36805Akaunting version 2.1.12 and earlier suffers from a persiste…4.8
• CVE-2021-36806 A reflected XSS vulnerability allows an open redirect when …6.1
• CVE-2021-36807An authenticated user could potentially execute code via an …8.8
• CVE-2021-36808A local attacker could bypass the app password using a race …7
• CVE-2021-36809A local attacker can overwrite arbitrary files on the system…6
• CVE-2021-36810Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2021-36811Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2021-36812Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2021-36813Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2021-36814Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2021-36815Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…