CVE-2026-80158

The record

A flaw was found in the ipa_getkeytab module of the community.general Ansible collection. The module's bind_pw parameter, used to supply the LDAP simple-bind password when retrieving a Kerberos keytab, is not declared with no_log, unlike the sibling password parameter in the same module. As a consequence, the supplied IPA/LDAP bind password is recorded in cleartext in the managed host's system journal/syslog (the module's "Invoked with" record), is included in the module's return values and verbose (-v) output, and is displayed in Automation Controller / AWX job output. The password is additionally passed on the command line to the ipa-getkeytab helper (as --bindpw <value>), exposing it in the process list to local users while the command runs. An attacker able to read these logs, job output, or the process table can obtain the directory bind credential, potentially compromising the accounts and objects that credential can access.

Affected packages

Related vulnerabilities

• CVE-2026-81684 In openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8, the desktop GUI… CWE-214
• CVE-2026-65088 NVIDIA NemoClaw contains a vulnerability where an attacker could cause invocation of… CWE-214
• CVE-2026-18915 Invocation of process using visible sensitive information vulnerability in TÜBİTAK BİLGEM… CWE-214
• CVE-2026-12139 Tanium addressed an information disclosure vulnerability in Connect. CWE-214
• CVE-2026-9494 An information disclosure vulnerability exists in Canonical ubuntu-pro-client (formerly… CWE-214
• CVE-2026-12250 Invocation of process using visible sensitive information vulnerability in TUBITAK BILGEM… CWE-214
• CVE-2026-41357 OpenClaw before 2026.3.31 contains an environment variable leakage vulnerability in… CWE-214
• CVE-2026-40159 PraisonAI is a multi-agent teams system. CWE-214