CVE-2026-80158: 
Ansible vulnerability analysis and mitigation

CVE-2026-80158 is a sensitive information disclosure vulnerability in the ipa_getkeytab module of the community.general Ansible collection. The module's bind_pw parameter — used to supply the LDAP simple-bind password when retrieving a Kerberos keytab — is not declared with no_log=True, causing the IPA/LDAP bind password to be exposed in multiple channels including system logs, Automation Controller/AWX job output, and the process list. It affects the ansible-collection-community-general package as distributed by Red Hat (including products such as Red Hat OpenStack Platform and Red Hat Ceph Storage). The vulnerability was published on August 26, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat CVE, Github Advisory).

The root cause is classified as CWE-214 (Invocation of Process Using Visible Sensitive Information). The bind_pw argument in plugins/modules/ipa_getkeytab.py is declared without no_log=True, unlike the sibling password parameter in the same module. This results in the password being exposed through at least three vectors: (1) cleartext logging in the managed host's journal/syslog via the module's "Invoked with" record and verbose (-v) output; (2) process-list exposure, as the password is passed directly to the ipa-getkeytab child process as --bindpw <value>, making it visible in ps or /proc/<pid>/cmdline to local users during execution; and (3) inclusion in the module's return values and Automation Controller/AWX job output. Ansible-core's name-based auto-redaction heuristic (PASSWORD_MATCH regex) does not apply because neither bind_pw nor bindpw contains the literal substring pass required by the pattern (Red Hat Bugzilla).

Successful exploitation allows a local attacker with access to system logs, AWX/Automation Controller job output, or the process table to obtain the IPA/LDAP directory bind credential in cleartext. This credential could then be used to access or modify LDAP directory objects, Kerberos principals, and any accounts or resources governed by the compromised bind account, potentially enabling lateral movement within the identity infrastructure. There is no integrity or availability impact; the vulnerability is purely a confidentiality issue (Red Hat CVE, Github Advisory).

There is no known public proof-of-concept exploit code, no evidence of in-the-wild exploitation, and no threat actor attribution at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.102%, indicating a low near-term exploitation probability. Exploitation requires local access (low privileges) to read logs, job output, or the process table — it is not remotely exploitable and is not automatable (Github Advisory, Red Hat CVE).

1. Gain local access: Obtain a low-privileged local account on a managed host where Ansible playbooks using the community.general.ipa_getkeytab module are executed, or gain access to the Automation Controller/AWX instance.
2. Read system journal/syslog: Run journalctl or inspect /var/log/syslog / /var/log/messages and search for "Invoked with" entries from Ansible module executions to find the bind_pw value logged in cleartext.
3. Monitor the process list: Use ps aux, cat /proc/<pid>/cmdline, or a process-monitoring tool to observe the ipa-getkeytab child process command line while the module is executing, capturing the --bindpw <value> argument.
4. Access AWX/Controller job output: If the attacker has access to Automation Controller or AWX, review job output logs for runs that invoked ipa_getkeytab with bind_pw set — the password will appear in verbose output.
5. Use the credential: Authenticate to the IPA/LDAP directory using the recovered bind credential to enumerate, modify, or exfiltrate directory objects and Kerberos principals (Red Hat Bugzilla).

• Logs: Entries in /var/log/syslog, /var/log/messages, or journalctl output containing "Invoked with" from Ansible module execution that include a bind_pw field with a plaintext value.
• Logs: Automation Controller or AWX job logs showing bind_pw=<password> in verbose (-v) Ansible output or module return values.
• Process: Short-lived ipa-getkeytab processes with --bindpw <value> visible in ps aux or /proc/<pid>/cmdline output during Ansible playbook execution.
• Network: Unexpected LDAP simple-bind authentication attempts to the IPA/FreeIPA server from hosts or accounts not normally performing such operations, potentially indicating credential reuse after exposure (Red Hat Bugzilla).

The fix requires adding no_log=True to the bind_pw argument declaration in plugins/modules/ipa_getkeytab.py within the community.general Ansible collection. Users should monitor the upstream community.general collection and Red Hat's errata for a patched release. As an immediate workaround, avoid using the bind_pw parameter in playbooks where possible, rotate any IPA/LDAP bind passwords that may have been exposed in logs or job output, restrict access to system journals and AWX/Automation Controller job logs to authorized personnel only, and audit log retention policies to purge historical entries containing the exposed credential (Red Hat CVE, Red Hat Bugzilla).

Red Hat acknowledged the vulnerability and credited Arpit Jain (GitHub handle: arpitjain099) for responsible disclosure. The bug was filed via Red Hat's OSIDB automated import system and is tracked in Red Hat Bugzilla with medium severity. No significant broader community commentary or media coverage has been identified at this time (Red Hat CVE, Red Hat Bugzilla).