Log in Start free

Vulnerability · Published Aug 26, 2026 · Assigned by redhat

CVE-2026-80158Ansible-collection-community-general: community.general: ipa_getkeytab does not set no_log on the bind_pw parameter, disclosing the ipa bind password in logs and process listings

Medium 5.5

In plain English

A medium-severity security flaw in Red Hat Ceph Storage 5 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities).

Severity (CVSS 3.1)5.5Medium
Exploit odds (30 days)0.1%top 96.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A flaw was found in the ipa_getkeytab module of the community.general Ansible collection. The module's bind_pw parameter, used to supply the LDAP simple-bind password when retrieving a Kerberos keytab, is not declared with no_log, unlike the sibling password parameter in the same module. As a consequence, the supplied IPA/LDAP bind password is recorded in cleartext in the managed host's system journal/syslog (the module's "Invoked with" record), is included in the module's return values and verbose (-v) output, and is displayed in Automation Controller / AWX job output. The password is additionally passed on the command line to the ipa-getkeytab helper (as --bindpw <value>), exposing it in the process list to local users while the command runs. An attacker able to read these logs, job output, or the process table can obtain the directory bind credential, potentially compromising the accounts and objects that credential can access.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12ansibleno fix listedDEBIAN-CVE-2026-80158
Debian:13ansibleno fix listedDEBIAN-CVE-2026-80158
Debian:14ansibleno fix listedDEBIAN-CVE-2026-80158
Ubuntu:24.04:LTSansibleno fix listedUBUNTU-CVE-2026-80158
Ubuntu:26.04:LTSansibleno fix listedUBUNTU-CVE-2026-80158
Ubuntu:26.10ansibleno fix listedUBUNTU-CVE-2026-80158
Ubuntu:22.04:LTSansible-coreno fix listedUBUNTU-CVE-2026-80158
Ubuntu:24.04:LTSansible-coreno fix listedUBUNTU-CVE-2026-80158
Ubuntu:26.04:LTSansible-coreno fix listedUBUNTU-CVE-2026-80158
Ubuntu:26.10ansible-coreno fix listedUBUNTU-CVE-2026-80158

Affected products (as reported)

VendorProductVersions
Red Hat Red Hat Ceph Storage 5 see references
Red Hat Red Hat Ceph Storage 9 see references
Red Hat Red Hat OpenStack Platform 17.1 see references
Red Hat Red Hat OpenStack Platform 18.0 see references

Weakness: CWE-214 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References