CVE-2026-80158: 
Ansible vulnerability analysis and mitigation

CVE-2026-80158 is an information disclosure vulnerability in the ipa_getkeytab module of the community.general Ansible collection, caused by the bind_pw parameter not being declared with no_log=True. As a result, the IPA/LDAP bind password is exposed in cleartext through multiple channels including system journal/syslog, Automation Controller/AWX job output, module return values, and the process list. The vulnerability was disclosed on August 26, 2026, and affects the ansible-collection-community-general package as distributed by Red Hat. It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat CVE, Github Advisory).

The root cause is classified as CWE-214 (Invocation of Process Using Visible Sensitive Information), with contributing elements of CWE-532 (log disclosure) and CWE-312 (cleartext storage). The bind_pw argument in plugins/modules/ipa_getkeytab.py is declared as dict(type="str") without no_log=True, unlike the sibling password parameter. Ansible-core's automatic name-based redaction heuristic (PASSWORD_MATCH regex) does not catch bind_pw or bindpw because neither contains the literal substring pass. Additionally, the module passes the password directly to the ipa-getkeytab child process via --bindpw <value> on the command line, making it visible in /proc/<pid>/cmdline and ps output to any local user during execution — a vector that no_log alone cannot remediate (Red Hat Bugzilla, Red Hat CVE).

Successful exploitation results in a high confidentiality impact: an attacker who can read system logs, AWX/Automation Controller job output, or the process table can obtain the plaintext IPA/LDAP bind credential. This credential may grant access to directory objects, Kerberos keytabs, and associated accounts managed by FreeIPA, potentially enabling lateral movement within the identity infrastructure. Integrity and availability are not directly impacted by this vulnerability (Red Hat CVE, Github Advisory).

Exploitation requires local access with low privileges — an attacker must be able to read system journal/syslog entries, AWX job output, or run ps/inspect /proc on the managed host during module execution. No exploit code or proof-of-concept has been publicly reported, and there is no evidence of in-the-wild exploitation. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (Red Hat CVE, Github Advisory).

1. Gain local access: Obtain a low-privileged local account on the managed host where the ipa_getkeytab Ansible module is being executed.
2. Monitor the process list: While the module runs, execute ps aux | grep ipa-getkeytab or read /proc/<pid>/cmdline to capture the --bindpw <value> argument containing the plaintext bind password.
3. Read system logs: Access the system journal (journalctl) or syslog to find the Ansible "Invoked with" log entry, which records all module parameters including bind_pw in cleartext.
4. Access AWX/Controller output: If the attacker has access to Automation Controller or AWX job output (e.g., via a shared account or misconfigured RBAC), retrieve the bind password from verbose job logs.
5. Use the credential: Authenticate to the FreeIPA/LDAP directory using the recovered bind_pw credential to access or modify directory objects, retrieve Kerberos keytabs, or escalate privileges within the identity infrastructure (Red Hat Bugzilla).

• Logs: Ansible "Invoked with" entries in /var/log/messages, journalctl, or syslog containing bind_pw=<plaintext_password> from ipa_getkeytab module invocations.
• Logs: AWX or Automation Controller job output displaying bind_pw parameter values in verbose mode.
• Process: Short-lived ipa-getkeytab child processes with --bindpw <value> visible in ps aux or /proc/<pid>/cmdline output during Ansible playbook execution.
• File System: Ansible log files or callback plugin output files containing cleartext bind_pw values stored on disk.

The fix requires declaring bind_pw with no_log=True in the ipa_getkeytab module's argument spec (plugins/modules/ipa_getkeytab.py). Users should monitor the upstream community.general collection for a patched release and update as soon as one is available. As an interim workaround, avoid using the bind_pw parameter in playbooks where possible, restrict access to system journals and AWX job output to authorized personnel only, and rotate any IPA/LDAP bind passwords that may have been exposed through logs or process listings (Red Hat CVE, Red Hat Bugzilla).

Red Hat acknowledged the issue and credited the reporter arpitjain099 for responsible disclosure. The vulnerability was filed as Red Hat Bugzilla #2524651 and is tracked under the Security Response product component. No significant broader community or media commentary has been identified at this time (Red Hat CVE, Red Hat Bugzilla).