A flaw was found in the community.general Ansible collection's
jenkins_credential module (plugins/modules/jenkins_credential.py).
When credential_type is set to "token", the module calls the Jenkins
API to generate a new API token. The response containing the token
value is stored at line 793: result["token"] = response_data["data"]
["tokenValue"], and the full result dict is returned via
module.exit_json(**result) at line 794. While the module's argument
specification correctly declares jenkins_password with no_log=True
(line 527), preventing the input password from appearing in Ansible
output, the generated token in the return value has no output
suppression. This causes the token to be exposed through: (1)
standard Ansible task output visible in terminal and logs; (2)
AWX/Tower/AAP Controller job logs stored in the database; (3)
Ansible callback plugins (log_plays, syslog_json, splunk); (4)
CI/CD pipeline build logs; (5) fact caching backends if the result
is registered and cached. The reporter's suggested fix — removing
tokenValue from the result dict and returning only tokenUuid — is
the correct remediation.

  Upstream: https://github.com/ansible-collections/community.general
    Affected version: all versions containing jenkins_credential module
    Fixed version: (pending upstream fix)