Bug 2567188 (CVE-2026-123036)
| Summary: | CVE-2026-123036 ansible-core: no_log does not censor the task exception field, leaking secret values via the default stdout callback | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security <prodsec-ir-bot> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | cahl, jlanda, jmitchel, jwong, kshier, ljawale, msilmser, rbobbitt, simaishi, stcannon, tguha, yguenane |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in ansible-core. When a task marked `no_log: true` fails, the task result is censored before being emitted, but the `exception` field is retained because it is present in the PRESERVE allow-list in lib/ansible/_internal/_task.py, and the default stdout callback prints it through CallbackBase._handle_exception. As a result, sensitive values the operator explicitly asked to hide can be disclosed: module argument-validation errors echo the argument value, templating errors print an Origin source snippet (the failing line plus the two preceding lines of the variables file, exposing neighbouring secrets from an -e @secrets.yml file), and fail/assert messages are printed in full. Secret material supplied as extra variables or variables files can therefore leak to terminal output, CI logs, and the stdout logs of any automation wrapping ansible-playbook, even though every task touching the secrets is marked no_log: true. This is a regression introduced with the ansible-core 2.19 data-tagging/templating rework; the behaviour does not occur on 2.16, where the error text is correctly censored.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
Verbatim report from Maksym Mazura via secalert. Impacted project ansible-core, verified on 2.21.5; `exception` listed in PRESERVE in lib/ansible/_internal/_task.py on v2.21.6rc1, v2.22.0rc2 and devel; not reproducible on 2.16.3. Three leak vectors: (1) module arg-validation value echoed, (2) templating Origin snippet of the vars file (failing line + two preceding lines), (3) full fail/assert msg; also under -vvv. INLINE reproducer provided: sec.yml (secret_a !unsafe "FAKEUNSAFE111", secret_b "FAKEPLAIN222 {{ nosuchvar }}"); pb.yml (command echo {{secret_b}}, wait_for port {{secret_a}}, fail msg {{secret_a}} - all no_log:true ignore_errors:true); run: ansible-playbook -i localhost, -c local -e @sec.yml pb.yml. Output on 2.21.5 shows FAKEUNSAFE111 and the secret_b line (plus preceding secret_a line) next to the "censored" notice. Suggested fix: do not preserve `exception` (or replace its message) when the result is censored, as 2.16 did; or have CallbackBase._handle_exception print fixed text for censored results. NOTE: no reproducer file/attachment was attached to the ticket - only the inline steps above; Red Hat has not yet independently reproduced. Disclosure: not public, no bounty requested.