A security team is running vulnerability scans against a CI/CD pipeline. The reports show that RDBMS secrets were found hardcoded in Ansible scripts. The RDBMS resides in the internal network that is

The question implies the scripts (and thus the secrets) have *already* been accessed by the attacker; the immediate risk is what the attacker can do *with* those secrets, not a compromise of the automation server itself.

While Ansible uses encrypted SSH connections, this only protects data in transit. It does not mitigate the risk of hardcoded secrets being exposed at rest if the scripts themselves are compromised.

Hardcoded RDBMS secrets provide an attacker with direct credentials to the database. Since the RDBMS is in the internal network and accessible via a jump server from the public network, these compromised secrets allow the attacker to bypass access controls and potentially gain unauthorized access to the internal database, leading to a compromise of that network segment.

While an RDBMS compromise can have broader implications, 'the entire CI/CD-related infrastructure' is too broad; the immediate and specific risk exposure described by hardcoded RDBMS secrets is primarily to the database and the internal network it resides within.