CVE-2026-11820: Ansible community.general nexmo credential exposure in GET query string

CVE-2026-11820 · Severity: medium · CVSS 6.5 · Published 2026-06-23

The Nexmo module in Ansible, used for sending SMS messages via the Vonage/Nexmo API, contains a flaw that exposes sensitive API credentials. Although the module is configured to hide these secrets from standard logs, it incorrectly sends them as part of a web address (URL) during communication. This means anyone with access to system logs, network proxies, or monitoring tools could see the plain-text credentials, potentially allowing unauthorized access to the organization's Nexmo account.

Technologies: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9. Vendors: Ansible, Red Hat.

Quick answers

Is CVE-2026-11820 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-11820 being exploited in the wild.
How severe is CVE-2026-11820?
Medium severity, with a CVSS score of 6.5, published 23 June 2026.
Which products and versions are affected?
Ansible Community.General Nexmo Module All versions prior to fix; Red Hat Enterprise Linux 10 rhel-system-roles; Red Hat Enterprise Linux 8 rhc-worker-playbook, rhel-system-roles; Red Hat Enterprise Linux 9 rhel-system-roles.
Is there a fix for CVE-2026-11820?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-11820 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-11820?
Check whether you run Ansible Community.General Nexmo Module, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The nexmo.py module in Ansible's community.general collection fails to protect sensitive credentials during transmission. While 'api_key' and 'api_secret' are marked with 'no_log=True' to prevent them from appearing in Ansible's standard output, the module constructs a GET request where these parameters are URL-encoded into the query string. This results in the credentials being exposed in Ansible verbose output (-vvv), web server access logs, HTTP proxy logs, and SIEM/network inspection tools. An attacker with low-privileged access to these logs can retrieve the credentials. The recommended fix is to transition the module to use POST requests with credentials contained in the request body.

Affected products

  • Ansible community.general nexmo module All versions prior to fix
  • Red Hat Red Hat Enterprise Linux 8 rhc-worker-playbook, rhel-system-roles
  • Red Hat Red Hat Enterprise Linux 9 rhel-system-roles
  • Red Hat Red Hat Enterprise Linux 10 rhel-system-roles

Timeline

  • 2026-06-15: disclosed: Initial report in Red Hat Bugzilla
  • 2026-06-23: advisory: CVE published and NVD record created

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.