REDHAT-BUG-2567188: Security vulnerability

Published Nov 5, 2026

Updated

Verbatim report from Maksym Mazura via secalert. Impacted project ansible-core, verified on 2.21.5; exception listed in PRESERVE in lib/ansible/internal/task.py on v2.21.6rc1, v2.22.0rc2 and devel; not reproducible on 2.16.3. Three leak vectors: (1) module arg-validation value echoed, (2) templating Origin snippet of the vars file (failing line + two preceding lines), (3) full fail/assert msg; also under -vvv. INLINE reproducer provided: sec.yml (secreta !unsafe "FAKEUNSAFE111", secretb "FAKEPLAIN222 {{ nosuchvar }}"); pb.yml (command echo {{secretb}}, waitfor port {{secreta}}, fail msg {{secreta}} - all nolog:true ignoreerrors:true); run: ansible-playbook -i localhost, -c local -e @sec.yml pb.yml. Output on 2.21.5 shows FAKEUNSAFE111 and the secretb line (plus preceding secreta line) next to the "censored" notice. Suggested fix: do not preserve exception (or replace its message) when the result is censored, as 2.16 did; or have CallbackBase.handleexception print fixed text for censored results. NOTE: no reproducer file/attachment was attached to the ticket - only the inline steps above; Red Hat has not yet independently reproduced. Disclosure: not public, no bounty requested.

Affected Software

0 affected components

Event History

Nov 5, 2026

Data Sourced

via Red Hat·07:23 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which environments are most likely to expose sensitive values?

The report concerns censored Ansible task results where no_log is enabled and an error is handled. It identifies leaks through module argument-validation output, templating errors that include variable-file source context, and fail or assert messages.

What conditions are needed for secrets to appear in output?

A task with no_log:true must produce one of the reported error conditions while sensitive data is present in the relevant argument, templated variable, or failure message. The supplied example also uses ignore_errors:true, allowing execution to continue after the censored failure output is displayed.

Which versions have been reported as affected or unaffected?

The issue was verified on ansible-core 2.21.5 and was not reproducible on 2.16.3. The exception-preservation behavior was also reported as present in 2.21.6rc1, 2.22.0rc2, and devel, but Red Hat had not independently reproduced the report.

What can be done if an update is not immediately available?

Avoid placing secrets in module arguments, templated values that may fail, or fail/assert messages for tasks relying on no_log. The report suggests suppressing or replacing preserved exception messages when a result is censored, including handling this in CallbackBase._handle_exception.

How can an administrator check for exposure?

Review playbook output, including output generated with -vvv, for supposedly censored task failures that reveal argument values, variable-file lines, or failure-message content. The report provides inline test steps, but no attachment was provided and the issue had not yet been independently reproduced by Red Hat.

REDHAT-BUG-2567188: Security vulnerability

Affected Software

Event History

Frequently Asked Questions

Which environments are most likely to expose sensitive values?

What conditions are needed for secrets to appear in output?

Which versions have been reported as affected or unaffected?

What can be done if an update is not immediately available?

How can an administrator check for exposure?

Company

Resources

Contact

Frequently Asked Questions

Which environments are most likely to expose sensitive values?

What conditions are needed for secrets to appear in output?

Which versions have been reported as affected or unaffected?

What can be done if an update is not immediately available?

How can an administrator check for exposure?