Ansible nexmo Module EUVD-2026-38605

The vulnerability triggers whenever the Ansible nexmo module is invoked to send an SMS, regardless of playbook flags, because the GET-based URL construction is unconditional. Exploitation is limited to parties who can access one of: Ansible control-node verbose output (requires -vvv flag or AWX debug logging enabled), network proxy or SIEM logs capturing HTTP GET URLs, or Vonage/Nexmo server-side access logs (requires compromise or insider access at Vonage). Authenticated access to run Ansible playbooks (PR:L) is required to generate the credential-bearing request, but the attacker harvesting the credentials does not need to be the operator - any log reader on any of the above systems suffices. No special Ansible configuration enables the flaw; it is present in all deployments using this module.

The CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) correctly characterizes the core exposure: network-traversing credential leakage requiring only low-privileged Ansible operator access. The C:H rating is well-justified because full API credential compromise enables an attacker to impersonate the victim account with Vonage. The I:N and A:N ratings are appropriate - this is a passive disclosure flaw with no direct write or denial-of-service capability against the Ansible host. No EPSS score was provided, and KEV status is not confirmed; exploitation does not require active network position but rather passive log access, which significantly lowers the exploitation barrier for insiders and log-system compromises. There is no conflicting signal between the CVSS vector and the description - PR:L is appropriate since the credentials belong to an operator running Ansible playbooks, and AV:N reflects that credentials traverse the network to Vonage's servers. Real-world risk is meaningful wherever Ansible verbose logging, AWX, or network inspection is enabled, but is bounded by the niche use of the nexmo module itself.

An insider or attacker with read access to Ansible AWX network debug logs or a network proxy that logs full request URLs searches for GET requests to rest.nexmo.com and extracts api_key and api_secret values directly from the query string. With these credentials the attacker authenticates to the Vonage API and can send fraudulent SMS messages or enumerate account details at the victim's expense. No exploit code is required beyond standard log inspection.