CVE-2026-80158

Name of the Vulnerable Software and Affected Versions community.general Ansible collection (affected versions not specified)

Description A flaw exists in the ipa getkeytab module where the bind pw parameter, used for LDAP simple-bind passwords during Kerberos keytab retrieval, lacks the no log declaration. This causes the password to be recorded in cleartext within the managed host's system journal or syslog, included in return values and verbose output, and displayed in Automation Controller or AWX job outputs. Additionally, the password is passed via the command line to the ipa-getkeytab helper using the --bindpw flag, making it visible in the process list to local users during execution. An attacker with access to these logs, outputs, or the process table could obtain the directory bind credential and compromise accessible accounts and objects.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, avoid using the bind pw parameter in the ipa getkeytab module until a patch is available.