CVE-2026-11819: Ansible keyring_info Module Credential Disclosure Vulnerability

Technical summary

CVE-2026-11819 is a credential disclosure vulnerability in Ansible's keyring_info module (plugins/modules/keyring_info.py). The module correctly marks its input parameter keyring_password with no_log=True on line 105, preventing that parameter from appearing in logs. However, on line 127, the retrieved passphrase is assigned directly to result["passphrase"] without any output suppression mechanism or _ansible_no_log flag. This causes the plaintext credential to be returned in the module's result dictionary, where it becomes visible to any Ansible construct that consumes the result—register statements, debug tasks, fact caching backends (Redis, JSON file, memcached), and centralized logging systems like AWX/Tower. The root cause is an inconsistency between input sanitization and output handling.

Business impact

Organizations using Ansible to automate secrets management face active credential exposure. Passphrases for SSH keys, database access, and service accounts can appear in searchable logs, version-controlled playbook execution records, and shared monitoring dashboards. In regulated environments (healthcare, finance, government), this creates compliance violations. For teams using AWX or Tower, job logs automatically persist these credentials, making them available to anyone with job history access. Downstream systems that consume Ansible facts or integrate with log aggregation platforms (Splunk, ELK, CloudWatch) will ingest and retain these secrets, expanding the blast radius of any log breach or insider threat.

Affected systems

Red Hat Enterprise Linux systems running Ansible with the keyring_info module are directly affected. Any host that uses this module to retrieve OS-level credentials and registers or logs that result is vulnerable. The impact extends to: AWX and Ansible Tower installations that execute playbooks using this module; fact caching systems (Redis, memcached, JSON file backends) that store module results; log aggregation and SIEM platforms that ingest Ansible task output; and CI/CD pipelines that run Ansible playbooks and retain job logs.

Exploitability

This vulnerability requires local access to run Ansible playbooks (AV:L) and valid Ansible privileges, but no user interaction is needed and no special exploit code is required—the credential disclosure happens automatically during normal module execution. Any user with permission to run playbooks or view task output can observe the leaked passphrases. The low attack complexity means misconfiguration or routine logging is sufficient to trigger exposure; there is no need for sophisticated techniques. This is not currently tracked as an actively exploited vulnerability in the wild (KEV status: false), but the ease of accidental disclosure through standard Ansible operations makes it a high-confidence finding.

Remediation

The immediate remediation is for Ansible developers to add _ansible_no_log=True to the module's exit_json call and to update module documentation with a clear warning that callers must use no_log: true at the task level as a defense-in-depth measure. Organizations should audit existing playbooks using keyring_info to ensure task-level no_log protection is applied. Additionally, review Ansible logs, fact caches, and centralized logging systems for instances of plaintext credentials that may have already been recorded and either purge them or restrict access. Consider implementing log filtering rules in aggregation platforms to redact credential patterns. Evaluate whether fact caching backends have been exposed and rotate any affected credentials.

Patch guidance

Consult the official Red Hat security advisory and Ansible project repository for the patched version of the keyring_info module. The fix involves modifying the module.exit_json() call to include _ansible_no_log=True, ensuring the passphrase field is marked as sensitive at the output level. When available, upgrade to the patched Ansible version and re-test any playbooks using keyring_info. Verify the patch by confirming that registered results no longer display the passphrase in verbose or debug output.

Detection guidance

Search Ansible logs and job histories for patterns where 'passphrase' or 'password' fields appear in module results alongside the keyring_info module name. Use log analysis tools to hunt for plaintext credential patterns (e.g., regex for common secret prefixes) in task output or registered variables. Check fact cache files (JSON, Redis, memcached) for entries containing the keyring_info module result. Review AWX/Tower job history for tasks executing keyring_info and verify that the 'passphrase' field is absent from stored output. Set up alerting on log aggregation platforms to flag any instances of keyring_info module execution combined with credential-like strings in the result set.

Why prioritize this

Although the CVSS score is 5.5 (MEDIUM), the real-world impact justifies higher prioritization. Credentials are stored in logs automatically and persistently, affecting compliance, expanding the window of exposure, and requiring costly breach response. The vulnerability is trivial to trigger and affects any organization using Ansible for credential management. The combination of high business sensitivity (secrets exposure), low exploitation barriers (standard Ansible usage), and persistence in logs elevates this above its numeric score. It should be treated as a high-priority patch in environments handling sensitive credentials.

Risk score, explained

CVSS 3.1 assigns a score of 5.5 (MEDIUM) based on: Attack Vector Local (the vulnerability requires local Ansible execution), Attack Complexity Low (no special conditions needed), Privileges Required Local (valid Ansible user required), User Interaction None (occurs automatically), Scope Unchanged (only the compromised system is affected), Confidentiality High (full credential exposure), Integrity None (credentials are not modified), and Availability None (no denial of service). The score reflects the local attack surface and lack of network exploitability. However, the high sensitivity of the exposed data (master passwords, SSH keys, service credentials) and the automatic persistence in logs, fact caches, and centralized systems warrant treating this as higher priority than the numeric score suggests.

Frequently asked questions