Source: ansible-core X-Debbugs-CC: [email protected] Severity: important Tags: security
Hi, The following vulnerability was published for ansible-core. CVE-2026-123036[0]: | A flaw was found in ansible-core. When a task marked `no_log: true` | fails, the task result is censored before being emitted, but the | `exception` field is retained because it is present in the PRESERVE | allow-list in lib/ansible/_internal/_task.py, and the default stdout | callback prints it through CallbackBase._handle_exception. As a | result, sensitive values the operator explicitly asked to hide can | be disclosed: module argument-validation errors echo the argument | value, templating errors print an Origin source snippet (the failing | line plus the two preceding lines of the variables file, exposing | neighbouring secrets from an -e @secrets.yml file), and fail/assert | messages are printed in full. Secret material supplied as extra | variables or variables files can therefore leak to terminal output, | CI logs, and the stdout logs of any automation wrapping ansible- | playbook, even though every task touching the secrets is marked | no_log: true. This is a regression introduced with the ansible-core | 2.19 data-tagging/templating rework; the behaviour does not occur on | 2.16, where the error text is correctly censored. https://bugzilla.redhat.com/show_bug.cgi?id=2567188 If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-123036 https://www.cve.org/CVERecord?id=CVE-2026-123036 Please adjust the affected versions in the BTS as needed.
