Information Disclosure in Ansible Community Module Affecting Red Hat

CVE-2026-80158

What is CVE-2026-80158?

A security flaw exists in the ipa_getkeytab module of the Ansible community.general collection. The issue arises from the module’s bind_pw parameter, which is intended for providing the LDAP simple-bind password necessary for retrieving a Kerberos keytab. Unlike its counterpart password parameter, bind_pw is not marked with no_log, resulting in sensitive information being recorded in cleartext in the system journal/syslog of managed hosts. This exposure allows the bind password to be seen in the module's return values, verbose output, and job outputs within Automation Controller / AWX. Additionally, the password is passed as a command line argument to the ipa-getkeytab helper, making it visible in the process list during execution. Attackers with access to these logs or process tables can potentially exploit this vulnerability to compromise directory bind credentials, posing significant risks to the security of associated accounts and objects.

References