EUVD-2026-38605
GHSA-87gp-wmhr-wgcw
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Credentials traverse network to Vonage (AV:N); operator must run playbooks (PR:L); no integrity or availability impact applies.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
2DescriptionCVE.org
Module: plugins/modules/nexmo.py
CVSS 3.1: 6.5 MEDIUM - AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Issue: api_key and api_secret are declared no_log=True at the input level, but both credentials are immediately URL-encoded into a GET request as query parameters, bypassing all no_log protection.
Vulnerable Code (lines 82-93):
msg = { "api_key": module.params.get("api_key"), "api_secret": module.params.get("api_secret"), "from": module.params.get("src"), "text": module.params.get("msg"), } url = f"{NEXMO_API}?{urlencode(msg)}" response, info = fetch_url(module, url, headers=headers)
Observed Output:
https://rest.nexmo.com/sms/json?api_key=a1b2c3d4&api_secret=MyS3cr3tK3y!!&from=AnsibleBot&to=15551234567&text=Hello
Exposure Vectors:
Ansible verbose output (-vvv) logs the full request URL
Vonage/Nexmo server access logs record credentials in query string
HTTP proxies, SIEM, and network inspection tools capture the full URL
AWX/Automation Controller network debug logs
Fix: Switch to POST with credentials in the request body:
data = urlencode({"api_key": api_key, "api_secret": api_secret, "from": src, "to": number, "text": msg}) fetch_url(module, NEXMO_API, data=data, method="POST", headers={"Content-Type": "application/x-www-form-urlencoded"})
AnalysisAI
Credential exposure in the Ansible nexmo module (plugins/modules/nexmo.py) causes Vonage/Nexmo API keys and secrets to appear in plaintext within HTTP GET request URLs, bypassing the no_log=True protection entirely. The module affects Red Hat Enterprise Linux 8, 9, and 10 deployments, and credentials are captured passively in Ansible verbose output, network proxy logs, SIEM traffic inspection, AWX/Automation Controller debug logs, and Vonage server-side access logs. No public exploit identified at time of analysis, though exploitation requires only read access to any of these log sources.
Technical ContextAI
CWE-532 (Insertion of Sensitive Information into Log File) describes this class of flaw: sensitive data inadvertently written to observable output. Here, the Ansible no_log=True directive suppresses module parameter values from appearing in Ansible task output, but it operates only at the Ansible parameter-logging layer - it has no effect on what the module subsequently does with those values. The module assembles a Python dict containing api_key and api_secret, passes it through urlencode(), and appends the result as a query string to a GET request targeting rest.nexmo.com. Ansible's fetch_url helper then issues the HTTP request, exposing the full URL (credentials included) in verbose mode (-vvv) and across any network path the request traverses. The CPE data confirms the module is distributed via Red Hat Enterprise Linux 8, 9, and 10 Ansible tooling packages. The Vonage REST API accepts credentials via GET query parameters, making this design choice possible but deeply unsafe in any logged environment.
RemediationAI
The recommended fix is to replace the HTTP GET with a POST request, placing credentials in the request body rather than the URL query string. The CVE description provides the corrected approach: use fetch_url with method='POST', encode api_key and api_secret into the POST body via urlencode, and set Content-Type to application/x-www-form-urlencoded - this ensures credentials never appear in URLs or URL-bearing log lines. No patched version number has been confirmed from available data; users should monitor https://access.redhat.com/security/cve/CVE-2026-11820 and https://bugzilla.redhat.com/show_bug.cgi?id=2488970 for patch availability. As an immediate compensating control, avoid running Ansible playbooks that use the nexmo module with verbose flags (-v, -vv, -vvv) and restrict access to AWX/Automation Controller network debug logs to minimize passive credential capture. Note that even without verbose logging, credentials remain exposed in Vonage server-side access logs and any network intermediaries, so suppressing local logging alone does not fully remediate the issue.
More in Red Hat Enterprise Linux 10
View allHeap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter
Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe
HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel
HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege
HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator
Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Containe
Same technique Authentication Bypass
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today