CVE-2026-123036
Awaiting Analysis Awaiting Analysis - Queue

Information Disclosure in Ansible-Core via Exception Logging

Publication date: 2026-11-05

Last updated on: 2026-11-05

Assigner: redhat-SADP

Description
A flaw was found in ansible-core. When a task marked `no_log: true` fails, the task result is censored before being emitted, but the `exception` field is retained because it is present in the PRESERVE allow-list in lib/ansible/_internal/_task.py, and the default stdout callback prints it through CallbackBase._handle_exception. As a result, sensitive values the operator explicitly asked to hide can be disclosed: module argument-validation errors echo the argument value, templating errors print an Origin source snippet (the failing line plus the two preceding lines of the variables file, exposing neighbouring secrets from an -e @secrets.yml file), and fail/assert messages are printed in full. Secret material supplied as extra variables or variables files can therefore leak to terminal output, CI logs, and the stdout logs of any automation wrapping ansible-playbook, even though every task touching the secrets is marked no_log: true. This is a regression introduced with the ansible-core 2.19 data-tagging/templating rework; the behaviour does not occur on 2.16, where the error text is correctly censored.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-05
Last Modified
2026-11-05
Generated
2026-11-05
AI Q&A
2026-11-05
EPSS Evaluated
N/A
NVD
CVE-2026-123036
EUVD
EUVD-2026-117403

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Red Hat ansible-core 2.19.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-209 The product generates an error message that includes sensitive information about its environment, users, or associated data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in ansible-core allows sensitive data to leak even when tasks are marked with no_log: true. When a task fails, error messages may include secret values from module arguments, templating errors, or fail/assert messages. This happens because the exception field is not properly censored despite no_log being set.

Detection Guidance

Check Ansible logs for exposed secrets in error messages or task results when tasks marked no_log: true fail. Look for module argument-validation errors, templating errors, or fail/assert messages in stdout or CI logs.

Impact Analysis

This flaw could expose secrets in CI logs, terminal output, or automation tool logs. Attackers with access to these logs might retrieve sensitive information like passwords, API keys, or configuration details that were meant to be hidden.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR, HIPAA, or other regulations requiring protection of sensitive data. Unauthorized disclosure of personal or health information may result in legal penalties, fines, or reputational damage.

Mitigation Strategies

Downgrade to ansible-core 2.16 or apply patches if available. Review playbooks to ensure no_log: true is correctly enforced. Avoid using extra variables or files for secrets until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-123036. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...