CVE-2026-80158: Invocation of Process Using Visible Sensitive Information in Red Hat Red Hat Ceph Storage 5

The ipa_getkeytab module's bind_pw parameter, which supplies the LDAP simple-bind password for retrieving a Kerberos keytab, is not declared with no_log. Consequently, the password is recorded in cleartext in system journal/syslog entries, included in module return values and verbose output, and displayed in Automation Controller/AWX job outputs. Additionally, the password is passed on the command line to the ipa-getkeytab helper, exposing it in the process list to local users during execution. An attacker with access to these logs, job outputs, or process listings can obtain the directory bind credential, potentially compromising accounts and objects accessible with that credential.

The vulnerability allows disclosure of the LDAP bind password to local users or attackers who can read system logs, job outputs, or process listings. This can lead to compromise of directory accounts and objects accessible via the exposed credential. The CVSS v3.1 score is 5.5 (medium severity) with high confidentiality impact but no integrity or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to system logs, Automation Controller/AWX job outputs, and process listings to trusted users only to reduce exposure risk. Avoid running the vulnerable module on untrusted hosts or environments.