CVE-2026-80158

Received Received - Intake

Password Exposure in Ansible community.general ipa_getkeytab

Publication date: 2026-08-26

Last updated on: 2026-08-26

Assigner: redhat-SADP

Description

A flaw was found in the ipa_getkeytab module of the community.general Ansible collection. The module's bind_pw parameter, used to supply the LDAP simple-bind password when retrieving a Kerberos keytab, is not declared with no_log, unlike the sibling password parameter in the same module. As a consequence, the supplied IPA/LDAP bind password is recorded in cleartext in the managed host's system journal/syslog (the module's "Invoked with" record), is included in the module's return values and verbose (-v) output, and is displayed in Automation Controller / AWX job output. The password is additionally passed on the command line to the ipa-getkeytab helper (as --bindpw <value>), exposing it in the process list to local users while the command runs. An attacker able to read these logs, job output, or the process table can obtain the directory bind credential, potentially compromising the accounts and objects that credential can access.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-26

Last Modified

2026-08-26

Generated

2026-08-27

AI Q&A

2026-08-27

EPSS Evaluated

N/A

NVD

CVE-2026-80158

EUVD

EUVD-2026-66808

Affected Vendors & Products

Vendor	Product	Version / Range
community_general	ansible	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-214	A process is invoked with sensitive command-line arguments, environment variables, or other elements that can be seen by other processes on the operating system.

Attack-Flow Graph

Executive Summary

This vulnerability involves the ipa_getkeytab module in the community.general Ansible collection. The module's bind_pw parameter, used for LDAP simple-bind passwords, is not protected with no_log. This causes the password to be logged in cleartext in system journals, syslog, module return values, verbose output, and Automation Controller/AWX job output. The password is also exposed in the process list via command-line arguments.

Detection Guidance

Check system logs and job output for cleartext LDAP bind passwords in the ipa_getkeytab module's records. Look for entries containing 'bind_pw' or 'Invoked with' followed by password values in /var/log/syslog, journalctl, or Automation Controller/AWX job logs.

Impact Analysis

An attacker with access to logs, job output, or the process table could retrieve the LDAP bind password. This could lead to unauthorized access to directory services, compromising accounts and objects the password can access. Local users could also exploit the command-line exposure to obtain credentials.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and confidentiality. Exposing credentials in logs and outputs could lead to unauthorized access, breaching GDPR's data protection principles and HIPAA's safeguards for protected health information.

Mitigation Strategies

Update the community.general Ansible collection to a version where the bind_pw parameter is declared with no_log. Rotate any exposed LDAP bind passwords immediately. Review and sanitize logs for any previously logged passwords.

Hi! I’m here to help you understand CVE-2026-80158. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70