The vulnerability exists in the Ansible module plugins/modules/keyring_info.py used in Red Hat Enterprise Linux 10. It improperly outputs sensitive passphrases retrieved from OS native keyrings (GNOME Keyring, macOS Keychain, Windows Credential Manager) directly into the result dictionary without no_log protection. This causes the passphrase to be visible in Ansible output, debug registers, fact caches (such as Redis, JSON file, memcached), and AWX/Tower job logs. The root cause is that while the input parameter is marked with no_log=True, the output passphrase is not protected, leading to unintended exposure of sensitive information. The vulnerability has a CVSS 3.1 score of 5.5 (medium) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. The vendor advisory does not explicitly confirm a patch or remediation level but suggests a fix involving adding _ansible_no_log=True on module exit and documenting the need for no_log at the task level.

Sensitive credentials such as master passwords and SSH key passphrases can be exposed in Ansible outputs, debug logs, fact caching backends, and AWX/Tower job logs. This exposure compromises confidentiality but does not affect integrity or availability. The leakage can lead to unauthorized access if logs or caches are accessed by unauthorized parties.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Meanwhile, users should apply no_log: true at the task level when using the affected module to prevent sensitive passphrases from being logged or cached. The vendor advisory suggests modifying the module to use _ansible_no_log=True on output to suppress sensitive information. Follow official Red Hat guidance at https://access.redhat.com/security/cve/CVE-2026-11819 for updates and remediation instructions.