EUVD-2026-38604
GHSA-5x67-m8gc-wm3p
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Local execution with low privileges required to run playbooks; passphrase exposed only through local output channels; no integrity or availability impact.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
2DescriptionCVE.org
Module: plugins/modules/keyring_info.py
CVSS 3.1: 5.5 MEDIUM - AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Issue: The module retrieves a passphrase from the OS native keyring (GNOME Keyring, macOS Keychain, Windows Credential Manager) and places it directly into result["passphrase"] with no output suppression, no no_log protection, and no documentation warning.
Root Cause:
Line 105 (protected): keyring_password=dict(type="str", required=True, no_log=True) Line 127 (NOT protected): result["passphrase"] = passphrase
Observed Output:
{ "changed": false, "passphrase": "MyMasterP@ssw0rd!SSH_Key_Secret" } Visible via register + debug: { "keyring_result": { "changed": false, "passphrase": "MyMasterP@ssw0rd!SSH_Key_Secret" } }
Impact:
Master passwords, SSH key passphrases and service credentials appear in all Ansible output
register: keyring_result followed by debug: var=keyring_result prints passphrase in full
Ansible fact caching backends (Redis, JSON file, memcached) may persist the passphrase
AWX/Tower job logs silently store the live credential
Fix:
module.exit_json(changed=False, passphrase=passphrase, _ansible_no_log=True)
Also add a documentation warning requiring callers to use no_log: true at the task level.
PoCs
Fig 1: PoC execution showing passphrase in plaintext output
Fig 2: Source code showing no_log=True on input (line 105) vs unprotected output (line 127)
AnalysisAI
Credential exposure in the Ansible keyring_info module (plugins/modules/keyring_info.py) causes master passwords, SSH key passphrases, and service credentials retrieved from OS-native keystores to be emitted as plaintext in task output, registered variables, and persistent log backends. Any local user with access to Ansible playbook output - including AWX/Tower job logs, Redis or JSON fact caches, and debug task output - can read credentials in full. A proof-of-concept demonstrating plaintext passphrase capture from Ansible output exists, though no confirmed active exploitation (CISA KEV) has been observed. Affected deployments span RHEL 8, 9, and 10 per Red Hat CPE data.
Technical ContextAI
The affected module queries OS-native credential stores - GNOME Keyring (Linux), macOS Keychain, and Windows Credential Manager - to retrieve passphrases for use in automation workflows. The root cause is CWE-532 (Insertion of Sensitive Information into Log File): the module correctly applies no_log=True to its input parameter keyring_password at line 105, preventing the lookup key from leaking, but then places the retrieved passphrase directly into result['passphrase'] at line 127 without any output suppression. In Ansible, task results are serialized and surfaced through multiple channels - debug: var= tasks, register variable dumps, stdout, and fact caching backends (Redis, memcached, flat JSON files). AWX and Automation Controller store full task results in their job log databases. Without _ansible_no_log=True in the module.exit_json() call or explicit no_log: true at the task level, the passphrase is treated as ordinary output data. CPE data confirms affected products are cpe:2.3:a:red_hat:red_hat_enterprise_linux_8, _9, and _10.
RemediationAI
The fix requires two changes in the module: replace the module.exit_json() call with one that passes _ansible_no_log=True alongside the passphrase return value, suppressing it from serialized output; and add documentation explicitly requiring callers to set no_log: true at the task level as a defense-in-depth measure. No vendor-released patched version has been independently confirmed - a specific fix version is not present in the available data; monitor https://access.redhat.com/security/cve/CVE-2026-11819 for an updated errata. Until a patch is available, operators should add no_log: true to every task invoking keyring_info, which prevents Ansible from logging the full task result; note this also suppresses changed/failed status detail in output. Additionally, audit and purge AWX/Tower job logs and any fact cache backends (Redis keys, JSON flat files, memcached entries) that may have already captured plaintext passphrases from prior runs. Restricting read access to fact cache backends and AWX job logs to minimum necessary personnel reduces exposure from already-logged credentials.
Privilege escalation to root in the LiteSpeed User-End cPanel Plugin (versions 2.3 through before 2.4.5) lets attackers
UAF in Redis 8.2.1 via crafted Lua scripts by authenticated users. EPSS 12.4%. Patch available.
It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific
Memory Corruption was discovered in the cmsgpack library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10,
Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user
Redis before 2.8.21 and 3.x before 3.0.2 allows remote attackers to execute arbitrary Lua bytecode via the eval command.
A buffer overflow in Redis 3.2.x prior to 3.2.4 causes arbitrary code execution when a crafted command is sent. Rated cr
Code injection in OneUptime monitoring via custom JS monitor using vm module. PoC and patch available.
In applications using jfinal 4.9.08 and below, there is a deserialization vulnerability when using redis,may be vulnerab
An issue was found in Apache Airflow versions 1.10.10 and below. Rated critical severity (CVSS 9.8), this vulnerability
An Integer Overflow issue was discovered in the struct library in the Lua subsystem in Redis before 3.2.12, 4.x before 4
goanother Another Redis Desktop Manager =<1.6.1 is vulnerable to Cross Site Scripting (XSS) via src/components/Setting.v
Same technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today