CVE-2026-11820: Ansible Nexmo Module Exposes API Credentials in Logs

Technical summary

The vulnerability (CWE-532: Insertion of Sensitive Information into Log Files) stems from a design flaw in how the nexmo module constructs API requests. Rather than placing API credentials in secure HTTP headers or request bodies, the module encodes api_key and api_secret as URL query parameters and sends them via GET requests to the Vonage/Nexmo API. This practice is fundamentally insecure because query parameters are logged extensively: they appear in web server access logs (Apache, Nginx), proxy server logs, browser history, HTTP Referer headers, and network packet captures. The Ansible no_log parameter only suppresses credentials in Ansible's own log output and console display—it does not prevent the underlying HTTP protocol from exposing them to external logging systems. The module's specification marks these fields as sensitive, but the implementation contradicts this specification.

Business impact

Organizations using the community.general nexmo module to send SMS messages via Ansible automation expose their Vonage/Nexmo API credentials across their logging infrastructure. Compromised credentials allow attackers to send SMS messages, access account details, enumerate phone numbers, and potentially redirect SMS-based authentication to accounts that rely on two-factor authentication. For enterprises managing SMS-based communications at scale, this can result in unauthorized SMS charges, disruption of legitimate SMS services, and lateral movement into accounts protected by SMS-based 2FA. The impact is amplified in organizations with centralized logging systems (ELK, Splunk, CloudWatch) where credentials may be indexed and searchable.

Affected systems

Red Hat Enterprise Linux systems running the community.general Ansible collection (versions prior to the fix) are directly affected. The vulnerability also affects any organization—regardless of Linux distribution—that deploys this Ansible collection for Vonage/Nexmo SMS automation. The risk extends to any system with access to logs or network monitoring tools that capture the HTTP requests made by the affected Ansible module.

Exploitability

Exploitability is straightforward for attackers with access to logging or monitoring infrastructure. No special tools or reverse engineering are needed; the credentials are present in plaintext in logs. Exploitation requires either internal network access (to proxy or network monitoring systems) or access to centralized logging systems. The CVSS score of 6.5 reflects the requirement for authenticated access (the user running the Ansible playbook must have credentials) and local or network-adjacent access to logs, balanced against the confidentiality impact of full credential disclosure. This is not a remote unauthenticated attack, but it is a high-confidence credential leak for anyone positioned to observe the HTTP traffic or logs.

Remediation

The primary remediation is to update the community.general Ansible collection to a patched version that uses HTTP headers (Authorization or custom headers) instead of query parameters for API credentials, or switches to POST requests with credentials in the request body. Additionally, organizations should audit log retention policies to identify and rotate any exposed Vonage/Nexmo API credentials. Restrict access to web server logs, proxy logs, and centralized logging systems to minimize the attack surface. Consider implementing log redaction rules to strip query parameters from URLs before storage. Until patching is possible, avoid using the nexmo module or run it in isolated, air-gapped environments with restricted log access.

Patch guidance

Consult the Red Hat security advisory and the Ansible community.general project repository for the specific patched version that fixes this credential exposure. Patches are expected to refactor the HTTP request construction to place credentials in request headers or bodies rather than URL parameters. Update your Ansible installation using your package manager (yum, apt, pip) and verify the community.general collection version against the vendor advisory. Test the patched module in a non-production environment before rolling out to automation pipelines that handle sensitive Vonage/Nexmo operations.

Detection guidance

Search web server and proxy access logs for HTTP requests to the Vonage/Nexmo API (api.nexmo.com or api.vonage.com) that contain 'api_key' or 'api_secret' in the query string. Use log aggregation tools to identify patterns such as GET requests with base64-encoded credentials or repeated API calls from Ansible automation servers. Monitor for any unauthorized access to Vonage/Nexmo accounts by checking account login history and SMS send logs. If credentials appear in logs, treat them as compromised and rotate them immediately via the Vonage/Nexmo console. Review proxy logs, CDN logs, and any network TAPs for exfiltration of credentials to external destinations.

Why prioritize this

Although the CVSS score is moderate (6.5), this vulnerability should be prioritized for organizations that use Ansible to automate SMS communications. The credential leak is high-confidence and low-effort to exploit for attackers with log access. SMS APIs are frequently targeted because they enable lateral movement into 2FA systems. The fix requires a simple update, making remediation straightforward. Prioritize patching if your organization has centralized logging, uses the nexmo module, or handles SMS-based authentication. De-prioritize only if you have verified that the nexmo module is not in use and your API credentials have restricted scope and monitoring.

Risk score, explained

CVSS 6.5 (MEDIUM) reflects: (1) High confidentiality impact—full API credentials are exposed; (2) No integrity or availability impact—the module does not enable tampering with API responses or denial of service; (3) Requirement for authenticated Ansible user—not exploitable by unauthenticated remote attackers; (4) Network-adjacent or internal access required—attacker must have access to logs or proxies that see the HTTP traffic. The score appropriately balances the severity of credential exposure against the limited attack surface. Organizations with broad log access, internet-facing proxies, or cloud logging should treat this as a higher risk.

Frequently asked questions