EUVD-2026-66808
GHSA-4m5f-rh76-cv72
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Local vector confirmed; low-privilege process-table or journal read suffices; only confidentiality is impacted via credential disclosure.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in the ipa_getkeytab module of the community.general Ansible collection. The module's bind_pw parameter, used to supply the LDAP simple-bind password when retrieving a Kerberos keytab, is not declared with no_log, unlike the sibling password parameter in the same module. As a consequence, the supplied IPA/LDAP bind password is recorded in cleartext in the managed host's system journal/syslog (the module's "Invoked with" record), is included in the module's return values and verbose (-v) output, and is displayed in Automation Controller / AWX job output. The password is additionally passed on the command line to the ipa-getkeytab helper (as --bindpw <value>), exposing it in the process list to local users while the command runs. An attacker able to read these logs, job output, or the process table can obtain the directory bind credential, potentially compromising the accounts and objects that credential can access.
AnalysisAI
Cleartext credential exposure in the ipa_getkeytab module of the community.general Ansible collection allows local users - or any principal with access to Automation Controller/AWX job logs - to recover the IPA/LDAP bind password supplied via bind_pw. The parameter is not marked no_log, causing the credential to appear verbatim in the system journal ('Invoked with' record), module return values, verbose Ansible output, AWX job logs, and the OS process list while ipa-getkeytab executes. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that (1) a playbook uses community.general.ipa_getkeytab with the bind_pw parameter populated (non-default - the parameter must be explicitly supplied by the playbook author), and (2) the attacker can read at least one of: the system journal/syslog on the managed host, the Automation Controller/AWX job output via the web UI or API, verbose Ansible output (-v flag), or the OS process table (ps/proc) while the ipa-getkeytab subprocess is running. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, score 5.5) is consistent with the described exposure: a low-privileged local user can read the process table or system journal without special configuration. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with a low-privileged shell on a managed Ansible host runs journalctl or reads /var/log/messages and locates the 'Invoked with' Ansible task record, which contains the bind_pw value in plaintext. Alternatively, an Automation Controller user with job-log read permission opens the AWX web UI and reads the credential directly from the job output. … |
| Remediation | The primary fix is to upgrade to a patched version of the community.general collection once released, as the fix entails adding no_log: true to the bind_pw parameter declaration. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today