Bipin Saud

**Name of the Vulnerable Software and Affected Versions** Ansible (affected versions not specified) **Description** The `plugins/modules/keyring info.py` module retrieves passphrases from native operating system keyrings, such as GNOME Keyring, macOS Keychain, and Windows Credential Manager. The issue occurs because the module places the retrieved passphrase directly into the `passphrase` variable within the result without output suppression or `no log` protection. Consequently, sensitive data like master passwords, SSH key passphrases, and service credentials may be exposed in Ansible output, stored in fact caching backends such as Redis, JSON files, or memcached, and recorded in AWX or Tower job logs. **Recommendations** Update the `plugins/modules/keyring info.py` module to use `module.exit json(changed=False, passphrase=passphrase, ansible no log=True)` to ensure output suppression. As a temporary mitigation, callers should use `no log: true` at the task level when utilizing this module.

**Name of the Vulnerable Software and Affected Versions** Ansible (affected versions not specified) **Description** In the `plugins/modules/nexmo.py` module, the `api key` and `api secret` variables are marked as `no log=True` to prevent them from being logged. However, these credentials are URL-encoded and included as query parameters in a GET request, which bypasses the protection. This leads to the exposure of sensitive credentials in verbose output, server access logs, HTTP proxies, SIEM, network inspection tools, and AWX/Automation Controller network debug logs. **Recommendations** Switch the request method to POST and include the `api key` and `api secret` variables within the request body instead of the URL.