CVE-2026-11820: 
Ansible vulnerability analysis and mitigation

CVE-2026-11820 is a credential disclosure vulnerability in the nexmo module (plugins/modules/nexmo.py) of the community.general Ansible collection. The module encodes API credentials (api_key and api_secret) into HTTP GET request URL query parameters when communicating with the Vonage/Nexmo SMS API, bypassing the no_log=True protection declared in the Ansible argument specification. All versions of community.general that include the nexmo module are affected, confirmed back to at least version 6.3.0; the module was removed in version 9.0.0. It was disclosed on June 23, 2026, with a CVSS v3.1 base score of 6.5 (Medium) (Github Advisory, Red Hat CVE).

The root cause is classified as CWE-532 (Insertion of Sensitive Information into Log File). The send_msg() function in nexmo.py constructs the Vonage REST API URL by passing all message parameters — including api_key and api_secret — through Python's urlencode() and appending them to the GET request URL, as shown below:

msg = {
    "api_key": module.params.get("api_key"),
    "api_secret": module.params.get("api_secret"),
    ...
}
url = f"{NEXMO_API}?{urlencode(msg)}"
response, info = fetch_url(module, url, headers=headers)

This results in URLs such as https://rest.nexmo.com/sms/json?api_key=a1b2c3d4&api_secret=MyS3cr3tK3y!!&... being recorded across multiple logging surfaces. Exploitation requires only low privileges (an authenticated Ansible user running the module) and no user interaction. The Vonage REST API supports POST requests with credentials in the request body, making this a correctable implementation deficiency (Github Advisory, Red Hat Bugzilla).

Successful exploitation results in full disclosure of Vonage/Nexmo API credentials (api_key and api_secret) to any party with access to web server access logs, reverse proxy logs, HTTP Referer headers, network packet captures, SIEM systems, or Ansible verbose output. An attacker obtaining these credentials can gain unauthorized access to the victim's Vonage/Nexmo account, potentially enabling SMS abuse, account takeover, or financial fraud. There is no integrity or availability impact; the vulnerability is limited to confidentiality (Github Advisory, Red Hat Bugzilla).

1. Identify target environment: Determine that the target organization uses the community.general Ansible collection version 6.3.0–8.x and runs playbooks that invoke the nexmo module to send SMS messages via the Vonage/Nexmo API.
2. Gain access to a logging surface: Obtain read access to one of the following: web server or reverse proxy access logs on the Ansible control node or any intermediate proxy, network traffic captures (e.g., via a MITM position or SIEM), Ansible verbose output logs (-vvv), or AWX/Automation Controller network debug logs.
3. Extract credentials from logs: Search logs for HTTP GET requests to https://rest.nexmo.com/sms/json and extract the api_key and api_secret values from the URL query string (e.g., api_key=a1b2c3d4&api_secret=MyS3cr3tK3y!!).
4. Authenticate to Vonage/Nexmo API: Use the harvested credentials to authenticate directly to the Vonage/Nexmo REST API, enabling unauthorized SMS sending, account enumeration, or further account takeover (Github Advisory, Red Hat Bugzilla).

• Network: HTTP GET requests to https://rest.nexmo.com/sms/json with api_key and api_secret visible in the URL query string; unexpected API calls to Vonage/Nexmo from unfamiliar IP addresses using harvested credentials.
• Logs: Web server or proxy access log entries containing rest.nexmo.com/sms/json?api_key=...&api_secret=...; Ansible verbose output (-vvv) logs showing full request URLs with embedded credentials; AWX/Automation Controller network debug logs with credential-bearing URLs.
• File System: Ansible log files or callback plugin output files containing plaintext api_key and api_secret values in URL format.
• Vonage/Nexmo Account Activity: Unexpected SMS messages sent from the account, unusual API usage patterns, or logins from unrecognized IP addresses in Vonage/Nexmo account audit logs (Github Advisory, Red Hat Bugzilla).

The upstream fix is the removal of the nexmo module in community.general version 9.0.0; no in-place patch exists for older versions. Organizations should upgrade to community.general 9.0.0 or later, which eliminates the vulnerable module entirely. As an immediate workaround, avoid using the nexmo module and migrate to an alternative SMS notification method that uses POST requests with credentials in the request body. Critically, any api_key and api_secret credentials that may have been exposed through logs or monitoring systems should be rotated immediately in the Vonage/Nexmo account dashboard. Additionally, review and purge any log files or monitoring data that may contain the exposed credentials (Github Advisory, Red Hat Bugzilla).

The vulnerability was reported by Bipin Saud (okBoss) and tracked via Red Hat's OSIDB system, with the Red Hat Bugzilla entry filed on June 15, 2026. Red Hat has acknowledged the issue across RHEL 8, 9, and 10 product streams where older versions of community.general remain packaged. No significant broader media coverage or notable researcher commentary beyond the advisory and bug report has been observed (Red Hat Bugzilla, Red Hat CVE).