CVE-2026-80158: Invocation of Process Using Visible Sensitive Information in Red Hat Red Hat Ceph Storage 5

The ipa_getkeytab module in the community.general Ansible collection improperly handles the bind_pw parameter by not declaring it with no_log, unlike the sibling password parameter. This results in the LDAP simple-bind password being recorded in cleartext in system journal/syslog, included in module return values and verbose output, and displayed in Automation Controller/AWX job output. Additionally, the password is passed on the command line to the ipa-getkeytab helper, exposing it in the process list to local users during execution. An attacker able to read these logs, job outputs, or the process table can obtain the directory bind credential, potentially compromising accounts and objects accessible with that credential.

The vulnerability allows disclosure of the LDAP bind password through multiple vectors including system logs, verbose module output, Automation Controller/AWX job output, and process listings. This exposure can lead to compromise of directory accounts and objects accessible with the leaked credential. The CVSS 3.1 score is 5.5 (medium severity) with a high confidentiality impact but no integrity or availability impact. Exploitation requires local access or the ability to read logs or job outputs.

No official fix or patch is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should restrict access to system logs, job outputs, and process listings to trusted users only to reduce the risk of credential disclosure. Avoid running the vulnerable module with verbose output in untrusted environments. Monitor Red Hat advisories for updates or patches addressing this issue.