Credential Exposure in Vonage Nexmo Module Affecting Security Practices

CVE-2026-11820

What is CVE-2026-11820?

The Nexmo module contains a significant vulnerability where sensitive credentials, such as api_key and api_secret, are improperly handled. Despite being marked as no_log=True, these credentials are URL-encoded in a GET request, allowing them to be logged in various places such as Ansible verbose outputs, server access logs, and network inspection tools, thereby exposing them to unauthorized access. To mitigate this issue, it is recommended to switch to using POST requests, which can safeguard sensitive information by including credentials in the request body rather than the URL. This practice aligns with better security standards.

References