CVE-2026-80158: Ansible ipa_getkeytab Information Disclosure

CVE-2026-80158 Overview

CVE-2026-80158 is an information disclosure flaw in the ipa_getkeytab module of the community.general Ansible collection. The module accepts a bind_pw parameter to supply the Lightweight Directory Access Protocol (LDAP) simple-bind password when retrieving a Kerberos keytab. The parameter is not declared with no_log, unlike the sibling password parameter in the same module. The bind credential is recorded in cleartext in syslog, module return values, verbose output, and Automation Controller / AWX job logs. The value is also passed on the command line to ipa-getkeytab as --bindpw, exposing it in the local process list.

Critical Impact
Local users and log readers can recover the IPA/LDAP bind password, enabling compromise of every directory account and object that credential can access.

Affected Products

Ansible community.general collection — ipa_getkeytab module
Red Hat Ansible Automation Platform (Automation Controller / AWX job output)
Managed hosts writing module invocations to journald or syslog

Discovery Timeline

2026-08-26 - CVE-2026-80158 published to the National Vulnerability Database (NVD)
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-80158

Vulnerability Analysis

The ipa_getkeytab module exposes an LDAP bind password through several concurrent channels because its argument specification omits no_log=True for the bind_pw field. Ansible relies on this per-argument flag to redact sensitive values from the Invoked with record, callback output, and fact-gathering artifacts. Without it, the plaintext password flows into every log surface Ansible touches.

The issue is compounded by how the module invokes the ipa-getkeytab helper. The password is placed directly on the command line as --bindpw <value>, which makes the argument visible to any local user reading /proc/<pid>/cmdline or running ps while the helper executes. This maps to [CWE-214: Invocation of Process Using Visible Sensitive Information].

Root Cause

The root cause is a missing no_log declaration on the bind_pw parameter in the module's argument_spec. The sibling password parameter is correctly marked, which confirms that redaction was intended but was not applied consistently across all secret-bearing inputs.

Attack Vector

Exploitation requires local access or read permission on aggregated logs. An attacker with shell access to the managed host can inspect the process table during playbook execution to capture the --bindpw argument. An attacker with access to journalctl, syslog forwarders, an AWX/Automation Controller job history, or verbose playbook output can retrieve the same credential without any code execution. The recovered bind password grants the attacker whatever directory read or write scope the account holds within FreeIPA or the target LDAP tree.

No synthetic exploitation code is required; the credential is emitted by design. See the Red Hat CVE-2026-80158 advisory for vendor analysis.

Detection Methods for CVE-2026-80158

Indicators of Compromise

Journald or syslog entries containing Invoked with records from the ipa_getkeytab module that include a populated bind_pw field
Process accounting or audit records showing ipa-getkeytab invocations with a --bindpw argument
AWX or Automation Controller job output where the bind_pw value is rendered in cleartext

Detection Strategies

Search centralized log storage for the strings ipa_getkeytab and bind_pw to identify exposed credentials that require rotation
Enable Linux auditd rules on execve for /usr/sbin/ipa-getkeytab and alert when --bindpw appears in argument vectors
Review Automation Controller job event streams for module results that expose invocation.module_args.bind_pw

Monitoring Recommendations

Forward journald and AWX job events to a central data lake and apply redaction rules before long-term retention
Track anomalous authentications against IPA/LDAP accounts whose credentials appeared in playbook logs
Monitor read access to log files that may contain historical ipa_getkeytab invocations, including backup archives

How to Mitigate CVE-2026-80158

Immediate Actions Required

Rotate every IPA/LDAP bind account credential that has been passed through ipa_getkeytab since the module was first used
Purge or redact archived journald, syslog, and Automation Controller records that contain the exposed bind_pw values
Restrict local shell access on managed hosts while playbooks that call ipa_getkeytab are executing

Patch Information

Update the community.general Ansible collection to a release that declares no_log=True on the bind_pw parameter and routes the password to ipa-getkeytab through an environment variable or stdin rather than the command line. Consult the Red Hat CVE-2026-80158 advisory and the Red Hat Bug Report #2524651 for fixed collection versions and Red Hat Ansible Automation Platform errata.

Workarounds

Wrap the bind_pw value with no_log: true at the task level to suppress module output in playbook logs, noting that this does not remove the process-list exposure
Prefer Kerberos-based authentication (ipa_host with a valid ticket) instead of LDAP simple bind where the environment allows
Restrict journald and syslog read permissions, and disable verbose (-v) execution modes in production automation pipelines

bash

# Task-level redaction workaround (does not fix --bindpw process exposure)
- name: Retrieve keytab
  community.general.ipa_getkeytab:
    principal: "HTTP/host.example.com"
    keytab: "/etc/krb5.keytab"
    ipa_host: "ipa.example.com"
    bind_dn: "uid=admin,cn=users,cn=accounts,dc=example,dc=com"
    bind_pw: "{{ vault_ipa_bind_pw }}"
  no_log: true