CVE-2026-11820

Name of the Vulnerable Software and Affected Versions Ansible (affected versions not specified)

Description In the plugins/modules/nexmo.py module, the api key and api secret variables are marked as no log=True to prevent them from being logged. However, these credentials are URL-encoded and included as query parameters in a GET request, which bypasses the protection. This leads to the exposure of sensitive credentials in verbose output, server access logs, HTTP proxies, SIEM, network inspection tools, and AWX/Automation Controller network debug logs.

Recommendations Switch the request method to POST and include the api key and api secret variables within the request body instead of the URL.