CVE-2026-123036 · Package
NO FIX YET
When a task marked no_log: true fails, ansible-core 2.19 still prints the exception field through the default stdout callback. Secret values from failed tasks, variables files or assert messages can end up in terminal output and CI logs.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams running ansible-playbook on ansible-core 2.19 that pass secrets through extra variables or variables files and rely on no_log to hide them. The regression is described as absent on 2.16. Teams not on 2.19 or not handling secrets this way can likely skip it.
Not affected if ansible-core-2.16, no-secrets-in-variables, no-stdout-logging
Who cares ansible, ansible-core, ci-cd, python
ansible-core --version or ansible --version and check whether the version is 2.19 or later.no_log: true to hide secrets loaded from -e @secrets.yml or similar variables files.No fix yet, per the sources.
A flaw was found in ansible-core. When a task marked no_log: true fails, the task result is censored before being emitted, but the exception field is retained because it is present in the PRESERVE allow-list in lib/ansible/_internal/_task.py, and the default stdout callback prints it through CallbackBase._handle_exception. As a result, sensitive values the operator explicitly asked to hide can be disclosed: module argument-validation errors echo the argument value, templating errors print an Origin source snippet (the failing line plus the two preceding lines of the variables file, exposing neighbouring secrets from an -e @secrets.yml file), and fail/assert messages are printed in full. Secret material supplied as extra variables or variables files can therefore leak to terminal output, CI logs, and the stdout logs of any automation wrapping ansible-playbook, even though every task touching the secrets is marked no_log: true. This is a regression introduced with the ansible-core 2.19 data-tagging/templating rework; the behaviour does not occur on 2.16, where the error text is correctly censored.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.