---
id: "CVE-2026-123036"
kind: "vulnerability"
aliases: ["CVE-2026-123036"]
title: "Ansible-core: no_log tasks still print secrets in failure output"
severity: "medium"
cvss: 5.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["ansible", "ansible-core", "ci-cd", "package", "python"]
not_affected_if: ["ansible-core-2.16", "no-secrets-in-variables", "no-stdout-logging"]
published_at: "2026-11-05T10:16:38+00:00"
first_seen_at: "2026-11-05T10:38:31+00:00"
updated_at: "2026-11-05T10:38:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123036", "first_seen_at": "2026-11-05T10:38:31+00:00"}]
exploit_sources: []
---

# Ansible-core: no_log tasks still print secrets in failure output

When a task marked no_log: true fails, ansible-core 2.19 still prints the exception field through the default stdout callback. Secret values from failed tasks, variables files or assert messages can end up in terminal output and CI logs.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `ansible-core --version` or `ansible --version` and check whether the version is 2.19 or later.
- Check whether playbooks rely on `no_log: true` to hide secrets loaded from `-e @secrets.yml` or similar variables files.
- Look at CI or wrapper logs from failed playbook runs for secret values.

## Timeline

- 2026-11-05T10:38:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123036

## From the sources

A flaw was found in ansible-core. When a task marked `no_log: true` fails, the task result is censored before being emitted, but the `exception` field is retained because it is present in the PRESERVE allow-list in lib/ansible/_internal/_task.py, and the default stdout callback prints it through CallbackBase._handle_exception. As a result, sensitive values the operator explicitly asked to hide can be disclosed: module argument-validation errors echo the argument value, templating errors print an Origin source snippet (the failing line plus the two preceding lines of the variables file, exposing neighbouring secrets from an -e @secrets.yml file), and fail/assert messages are printed in full. Secret material supplied as extra variables or variables files can therefore leak to terminal output, CI logs, and the stdout logs of any automation wrapping ansible-playbook, even though every task touching the secrets is marked no_log: true. This is a regression introduced with the ansible-core 2.19 data-tagging/templating rework; the behaviour does not occur on 2.16, where the error text is correctly censored.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_