Executive brief
A vulnerability in an Ansible module used for retrieving passwords from system keychains causes sensitive passphrases to be printed in plain text within automation logs. This means that master passwords, SSH keys, and other credentials stored in GNOME Keyring, macOS Keychain, or Windows Credential Manager could be exposed to anyone with access to job logs or system caches. This exposure can lead to unauthorized access to sensitive infrastructure and services.
Technical details
The keyring_info.py module in the Ansible community.general collection (v13.0.0) contains an information disclosure vulnerability (CWE-532). While the module correctly uses no_log=True for input parameters, it fails to apply similar protections to the returned result["passphrase"] field. An attacker with local access to Ansible job logs, fact caches (such as Redis or Memcached), or AWX/Tower history can retrieve sensitive credentials in plaintext. The vulnerability affects systems using GNOME Keyring, macOS Keychain, and Windows Credential Manager. A fix involves setting _ansible_no_log=True in the module's exit_json call and updating documentation to recommend task-level no_log usage.
Affected products
- Ansible community.general v13.0.0
- Red Hat Red Hat Enterprise Linux 8
- Red Hat Red Hat Enterprise Linux 9
- Red Hat Red Hat Enterprise Linux 10
Timeline
- 2026-06-09: disclosed: Initial report to Red Hat Bugzilla
- 2026-06-23: advisory: NVD and Red Hat published advisory details