Sensitive Data Disclosure in Ansible Core by Red Hat

CVE-2026-123036

What is CVE-2026-123036?

An issue in Ansible Core allows for the unintended disclosure of sensitive information when tasks marked as 'no_log: true' fail. Despite efforts to censor task results, specific fields, including exceptions, can still be printed to outputs. This flaw can expose sensitive variables and secrets to terminal logs, CI logs, and stdout, potentially revealing critical information even when tasks are designed to obscure such data. It notably impacts version 2.19, which introduced changes that allowed the disclosure, while earlier versions like 2.16 handled errors correctly without revealing sensitive content.

References