CVE-2026-80158 in Ceph Storage
Summary
by MITRE • 08/27/2026
A flaw was found in the ipa_getkeytab module of the community.general Ansible collection. The module's bind_pw parameter, used to supply the LDAP simple-bind password when retrieving a Kerberos keytab, is not declared with no_log, unlike the sibling password parameter in the same module. As a consequence, the supplied IPA/LDAP bind password is recorded in cleartext in the managed host's system journal/syslog (the module's "Invoked with" record), is included in the module's return values and verbose (-v) output, and is displayed in Automation Controller / AWX job output. The password is additionally passed on the command line to the ipa-getkeytab helper (as --bindpw <value>), exposing it in the process list to local users while the command runs. An attacker able to read these logs, job output, or the process table can obtain the directory bind credential, potentially compromising the accounts and objects that credential can access.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/27/2026
The vulnerability identified within the ipa_getkeytab module of the community.general Ansible collection represents a critical information disclosure flaw stemming from improper handling of sensitive credentials during automated identity management operations. This specific issue affects the bind_pw parameter, which is utilized to supply the Lightweight Directory Access Protocol simple-bind password required for authenticating against an Identity Management server when retrieving Kerberos keytabs. The root cause lies in the module's configuration where this particular credential field was not declared with the no_log directive, a standard Ansible mechanism designed to mask sensitive data from output logs and console displays. This oversight stands in stark contrast to other password parameters within the same module that are correctly configured for log masking, indicating an inconsistency in security controls across similar functionality.
The operational impact of this flaw is severe due to the multiple vectors through which cleartext credentials become exposed. When the Ansible playbook executes, the bind_pw value is recorded in plain text within the managed host's system journal or syslog under the module's Invoked with record. Furthermore, the credential appears directly in the module's return values and verbose output generated during execution. In enterprise environments utilizing Automation Controller or AWX for orchestration, these logs are often centralized and accessible to a broader range of users involved in infrastructure management, significantly expanding the attack surface beyond just local system administrators. The exposure is not limited to static log files; the password is also passed as an argument on the command line to the underlying ipa-getkeytab helper utility using the --bindpw flag. This practice causes the credential to be visible in the process list of the operating system, allowing any local user with access to view running processes to capture the directory bind credential while the operation is active.
From a threat modeling perspective, this vulnerability aligns closely with CWE-532, which categorizes information exposure through log files, and CWE-780, referring to improper use of RSA algorithm or key sizes in contexts where weak cryptography leads to data leakage via side channels like process lists. The ability for an attacker to read system logs, job output artifacts, or the active process table enables them to harvest valid directory bind credentials without needing to exploit a software bug in the authentication logic itself. Once obtained, these cleartext passwords can be used by malicious actors to authenticate against the LDAP server, potentially leading to unauthorized access to sensitive account data and objects managed within the identity infrastructure. This scenario is consistent with ATT&CK technique T1003, specifically OS Credential Dumping via WMI or similar mechanisms depending on the operating system, as well as T1552 Unsecured Credentials where attackers target stored credentials for lateral movement or privilege escalation.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. The primary corrective action is to update the community.general Ansible collection to a version that includes the fix for this issue, ensuring that the bind_pw parameter is properly masked in all output channels including logs, return values, and verbose outputs. Administrators should also audit their current playbooks to ensure no other sensitive parameters are inadvertently exposed through similar oversights. In environments where log retention policies allow access to historical data, it is imperative to rotate any credentials that may have been logged during the period of vulnerability exposure. Additionally, organizations should consider implementing strict file permissions on system logs and job output directories to restrict read access only to authorized service accounts or administrators who strictly require such visibility for operational purposes, thereby reducing the risk of credential harvesting by lower-privileged users or compromised local processes.