Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-80158— Ansible-collection-community-general: community.general: ipa_getkeytab does not set no_log on the bind_pw parameter, disclosing the ipa bind password in logs and process listings

Quick assessment

Affected
Red Hat Red Hat Ceph Storage 5
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Ansible 集合的 模块中发现了一个漏洞。该模块中的 参数用于在获取 Kerberos keytab 时提供 LDAP 简单绑定密码，但该参数并未像同模块中相邻的 参数那样声明 属性。因此，提供的 IPA/LDAP 绑定密码会以明文形式记录在被管理主机的系统日志/syslog 中（即模块的 “Invoked with” 记录），同时还会出现在模块的返回值以及详细（ ）输出中，并显示在自动化控制器 / AWX 的任务输出里。此外，该密码还会作为 参数通过命令行传递给 辅助工具，导致在命令执行期间，本地用户可通

CVSS 5.5 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-80158

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Ansible-collection-community-general: community.general: ipa_getkeytab does not set no_log on the bind_pw parameter, disclosing the ipa bind password in logs and process listings
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in the ipa_getkeytab module of the community.general Ansible collection. The module's bind_pw parameter, used to supply the LDAP simple-bind password when retrieving a Kerberos keytab, is not declared with no_log, unlike the sibling password parameter in the same module. As a consequence, the supplied IPA/LDAP bind password is recorded in cleartext in the managed host's system journal/syslog (the module's "Invoked with" record), is included in the module's return values and verbose (-v) output, and is displayed in Automation Controller / AWX job output. The password is additionally passed on the command line to the ipa-getkeytab helper (as --bindpw <value>), exposing it in the process list to local users while the command runs. An attacker able to read these logs, job output, or the process table can obtain the directory bind credential, potentially compromising the accounts and objects that credential can access.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过处理环境导致的信息暴露
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Red Hat Red Hat Ceph Storage 5 - cpe:/a:redhat:ceph_storage:5
Red Hat Red Hat Ceph Storage 9 - cpe:/a:redhat:ceph_storage:9
Red Hat Red Hat OpenStack Platform 17.1 - cpe:/a:redhat:openstack:17.1
Red Hat Red Hat OpenStack Platform 18.0 - cpe:/a:redhat:openstack:18.0

II. Public POCs for CVE-2026-80158

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-80158

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-80158 (1)

Other References for CVE-2026-80158 (1)

IV. Related Vulnerabilities

Same vendor: Red Hat
Same weakness: CWE-214

V. Comments for CVE-2026-80158

No comments yet

Leave a comment