The vulnerability arises because the nexmo module in the community.general Ansible collection encodes API credentials (api_key and api_secret) into URL query parameters sent via HTTP GET requests to the Vonage/Nexmo SMS API. Despite the Ansible argument specification marking these parameters as no_log, the credentials are exposed in web server access logs, proxy logs, HTTP Referer headers, and network monitoring tools. This exposure allows an attacker with access to these logs or monitoring points to retrieve the full API credentials and gain unauthorized access to the associated Vonage/Nexmo account. The vulnerability affects Red Hat Enterprise Linux 10 cloud services using this module. The vendor manages remediation for this cloud-hosted service.

The exposure of API credentials in logs and network monitoring tools can lead to unauthorized access to the victim's Vonage/Nexmo account. This compromises the confidentiality of the API key and secret, potentially allowing an attacker to send SMS messages or perform other actions using the victim's account. There is no indication of impact on integrity or availability. No known exploits in the wild have been reported.

Since this is a cloud-hosted service, Red Hat manages remediation server-side. Users should refer to the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-11820 for the latest remediation status and guidance. Patch availability is indicated, so applying official updates or patches provided by Red Hat is recommended. No additional user action is specified in the vendor advisory.