Executive Summary

This vulnerability exists in the Ansible module plugins/modules/keyring_info.py. The module retrieves a passphrase from the operating system's native keyring (such as GNOME Keyring, macOS Keychain, or Windows Credential Manager) and places it directly into the output result without any suppression or protection.

Specifically, although the input passphrase is marked with no_log=True to protect it, the output passphrase is assigned to result["passphrase"] without any no_log protection or documentation warning. This causes the passphrase to be visible in Ansible outputs, debug logs, fact caching backends, and job logs.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to sensitive credentials such as master passwords, SSH key passphrases, and service credentials being exposed in plaintext in various outputs and logs.

• Passphrases appear in all Ansible output when using register and debug.
• Ansible fact caching backends like Redis, JSON files, or memcached may persist these passphrases.
• AWX/Tower job logs silently store the live credentials, increasing the risk of unauthorized access.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by observing Ansible output or logs for the presence of sensitive passphrases in plaintext. Specifically, if a task uses the keyring_info module and the passphrase appears in the output or debug information without suppression, it indicates the vulnerability.

You can check for this by running an Ansible playbook that uses the keyring_info module with a registered variable and then printing that variable with debug. For example:

• ansible-playbook playbook.yml --tags keyring_info
• In the playbook, use register: keyring_result followed by debug: var=keyring_result

If the output shows the passphrase in plaintext under keyring_result.passphrase, the vulnerability is present.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include modifying the keyring_info module to suppress the passphrase output by using the _ansible_no_log=True flag when returning the passphrase.

Additionally, callers of the module should use no_log: true at the task level to prevent the passphrase from appearing in logs or output.

Avoid registering and printing the passphrase variable directly in playbooks or debug tasks.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability causes sensitive information such as master passwords, SSH key passphrases, and service credentials to be exposed in Ansible outputs, logs, and fact caching backends without proper protection.

Such exposure of sensitive credentials can lead to non-compliance with common security and privacy standards like GDPR and HIPAA, which require strict controls to protect sensitive data and prevent unauthorized disclosure.

Specifically, the lack of output suppression and no_log protection means that confidential information may be stored in logs and caches, increasing the risk of data breaches and violating data protection requirements.

Useful 0 Not Useful 0