CVE-2026-80158 Red Hat CVE debrief

Who should care

Defenders responsible for managing Ansible deployments, especially those using Automation Controller or AWX, should assess exposure and prioritize remediation to prevent potential unauthorized access to sensitive credentials.

Why it matters

The CVE-2026-80158 vulnerability in the ipa_getkeytab module of the community.general Ansible collection can lead to disclosure of IPA/LDAP bind passwords in logs and process listings, potentially compromising directory credentials and sensitive accounts.

• Potential exposure of IPA/LDAP bind passwords to unauthorized users with access to system journals, Automation Controller job output, or process listings.
• Increased risk of compromised directory credentials, potentially allowing unauthorized access to sensitive accounts and objects.
• Need for defenders to verify and remediate this vulnerability in their Ansible deployments to prevent potential credential disclosure.
• Priority on restricting access to Automation Controller or AWX job output and system journals to prevent unauthorized users from obtaining bind passwords.

Technical summary

The ipa_getkeytab module in the community.general Ansible collection does not set the no_log parameter on the bind_pw variable, leading to disclosure of the IPA/LDAP bind password in logs and process listings. This allows the password to be recorded in cleartext in system journals, module return values, and Automation Controller job output. The password is also passed on the command line to the ipa-getkeytab helper, exposing it in the process list to local users. Defenders should prioritize verifying and remediating this vulnerability in their Ansible deployments, especially where Automation Controller or AWX job output may be accessible to unauthorized users.

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability in their Ansible deployments, especially where Automation Controller or AWX job output may be accessible to unauthorized users.

Recommended defensive actions

• Review and update Ansible playbooks to use the no_log parameter with the bind_pw variable.
• Verify Automation Controller or AWX job output and system journals for potential exposure of the IPA/LDAP bind password.
• Restrict access to Automation Controller or AWX job output and system journals to prevent unauthorized users from obtaining the bind password.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, affected products, and references to additional information. The ipa_getkeytab module in the community.general Ansible collection does not set the no_log parameter on the bind_pw variable, leading to disclosure of the IPA/LDAP bind password in logs and process listings. Defenders should verify system journals, Automation Controller or AWX job output, and process listings for potential exposure of the IPA/LDAP bind password. The lack of no_

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.