{"id":"CVE-2026-123036","kind":"vulnerability","aliases":["CVE-2026-123036"],"related":[],"title":"Ansible-core: no_log tasks still print secrets in failure output","description":"A flaw was found in ansible-core. When a task marked `no_log: true` fails, the task result is censored before being emitted, but the `exception` field is retained because it is present in the PRESERVE allow-list in lib/ansible/_internal/_task.py, and the default stdout callback prints it through CallbackBase._handle_exception. As a result, sensitive values the operator explicitly asked to hide can be disclosed: module argument-validation errors echo the argument value, templating errors print an Origin source snippet (the failing line plus the two preceding lines of the variables file, exposing neighbouring secrets from an -e @secrets.yml file), and fail/assert messages are printed in full. Secret material supplied as extra variables or variables files can therefore leak to terminal output, CI logs, and the stdout logs of any automation wrapping ansible-playbook, even though every task touching the secrets is marked no_log: true. This is a regression introduced with the ansible-core 2.19 data-tagging/templating rework; the behaviour does not occur on 2.16, where the error text is correctly censored.","summary":"When a task marked no_log: true fails, ansible-core 2.19 still prints the exception field through the default stdout callback. Secret values from failed tasks, variables files or assert messages can end up in terminal output and CI logs.","severity":"medium","cvss":5.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ansible","ansible-core","ci-cd","package","python"],"not_affected_if":["ansible-core-2.16","no-secrets-in-variables","no-stdout-logging"],"how_to_check":"- Run `ansible-core --version` or `ansible --version` and check whether the version is 2.19 or later.\n- Check whether playbooks rely on `no_log: true` to hide secrets loaded from `-e @secrets.yml` or similar variables files.\n- Look at CI or wrapper logs from failed playbook runs for secret values.","fix":null,"status":"open","published_at":"2026-11-05T10:16:38+00:00","first_seen_at":"2026-11-05T10:38:31+00:00","triaged_at":"2026-11-05T10:38:52+00:00","updated_at":"2026-11-05T10:38:52+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-05T10:38:52Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Ansible-core: no_log tasks still print secrets in failure output","impact":"medium","summary":"When a task marked no_log: true fails, ansible-core 2.19 still prints the exception field through the default stdout callback. Secret values from failed tasks, variables files or assert messages can end up in terminal output and CI logs.","audience":"developers","category":"package","nicknames":[],"who_cares":["ansible","ansible-core","ci-cd","python"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"secret values leak into terminal output and CI logs","analyst_note":"Confirm the fixed ansible-core version and whether a patch exists; the sources given do not state either.","how_to_check":"- Run `ansible-core --version` or `ansible --version` and check whether the version is 2.19 or later.\n- Check whether playbooks rely on `no_log: true` to hide secrets loaded from `-e @secrets.yml` or similar variables files.\n- Look at CI or wrapper logs from failed playbook runs for secret values.","plain_action":"","needs_analyst":true,"not_affected_if":["ansible-core-2.16","no-secrets-in-variables","no-stdout-logging"],"who_is_affected":"Teams running ansible-playbook on ansible-core 2.19 that pass secrets through extra variables or variables files and rely on no_log to hide them. The regression is described as absent on 2.16. Teams not on 2.19 or not handling secrets this way can likely skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000732,"input_tokens":4454,"output_tokens":574,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123036':15A,18A '-2026':14A,17A '/templating':231C '2.16':239C '2.19':39B,227C 'allow':107C 'allow-list':106C 'ansibl':2A,19B,21B,37B,75C,203C,225C 'ansible-cor':1A,20B,36B,74C,224C 'ansible-playbook':202C 'argument':136C,141C 'argument-valid':135C 'ask':128C 'assert':58B 'autom':200C 'behaviour':234C 'callback':49B,115C 'callbackbase._handle_exception':119C 'cd':25B 'censor':89C,246C 'ci':24B,67B,192C 'ci-cd':23B 'core':3A,22B,38B,76C,226C 'correct':245C 'cve':13A,16A 'data':229C 'data-tag':228C 'default':47B,113C 'disclos':133C 'e':167C 'echo':139C 'emit':92C 'end':61B 'error':138C,144C,242C 'even':205C 'everi':207C 'except':43B,95C 'explicit':127C 'expos':162C 'extra':181C 'fail':35B,53B,84C,151C 'fail/assert':171C 'failur':11A 'field':44B,96C 'file':56B,161C,169C,185C 'flaw':70C 'found':72C 'full':176C 'hide':130C 'introduc':221C 'leak':188C 'lib/ansible/_internal/_task.py':110C 'line':152C,157C 'list':108C 'log':5A,33B,68B,82C,193C,197C,215C 'mark':31B,80C,213C 'materi':178C 'messag':59B,172C 'modul':134C 'neighbour':163C 'occur':237C 'oper':126C 'origin':147C 'output':12A,65B,191C 'packag':26B 'playbook':204C 'plus':153C 'preced':156C 'present':102C 'preserv':105C 'print':8A,41B,116C,145C,174C 'python':27B 'regress':220C 'result':87C,122C 'retain':98C 'rework':232C 'secret':9A,50B,164C,177C,211C 'secrets.yml':168C 'sensit':123C 'snippet':149C 'sourc':148C 'stdout':48B,114C,196C 'still':7A,40B 'suppli':179C 'tag':230C 'task':6A,30B,54B,79C,86C,208C 'templat':143C 'termin':64B,190C 'text':243C 'therefor':187C 'though':206C 'touch':209C 'true':34B,83C,216C 'two':155C 'valid':137C 'valu':51B,124C,142C 'variabl':55B,160C,182C,184C 'wrap':201C","nicknames":[],"mitigations":[],"who_affected":"Teams running ansible-playbook on ansible-core 2.19 that pass secrets through extra variables or variables files and rely on no_log to hide them. The regression is described as absent on 2.16. Teams not on 2.19 or not handling secrets this way can likely skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ansible","ansiblecore","cicd","medium","package","python"],"campaign_type":null,"first_public_at":"2026-11-05T10:16:38+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123036","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123036","severity":null,"published_at":"2026-11-05T10:16:38+00:00","modified_at":"2026-11-05T10:16:38+00:00","first_seen_at":"2026-11-05T10:38:31+00:00","fetched_at":"2026-11-05T10:38:31+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}