DEBIAN-CVE-2026-123036

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-123036
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-123036.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-123036
Upstream
  • CVE-2026-123036
Published
2026-11-05T10:16:38Z
Modified
2026-11-06T23:00:06Z
Severity
  • 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
[none]
Details

A flaw was found in ansible-core. When a task marked no_log: true fails, the task result is censored before being emitted, but the exception field is retained because it is present in the PRESERVE allow-list in lib/ansible/_internal/_task.py, and the default stdout callback prints it through CallbackBase._handle_exception. As a result, sensitive values the operator explicitly asked to hide can be disclosed: module argument-validation errors echo the argument value, templating errors print an Origin source snippet (the failing line plus the two preceding lines of the variables file, exposing neighbouring secrets from an -e @secrets.yml file), and fail/assert messages are printed in full. Secret material supplied as extra variables or variables files can therefore leak to terminal output, CI logs, and the stdout logs of any automation wrapping ansible-playbook, even though every task touching the secrets is marked no_log: true. This is a regression introduced with the ansible-core 2.19 data-tagging/templating rework; the behaviour does not occur on 2.16, where the error text is correctly censored.

References

Affected packages

Debian:12 / ansible-core

Package

Name
ansible-core
Purl
pkg:deb/debian/ansible-core?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

2.*
2.14.3-1
2.14.6-1
2.14.7-1
2.14.8-1
2.14.9-1
2.14.9-2
2.14.10-1
2.14.11-1
2.14.11-2
2.14.13-1
2.14.16-0+deb12u1
2.14.18-0+deb12u1
2.14.18-0+deb12u2
2.16.5-1
2.16.6-1
2.17.0-1
2.17.1-1
2.17.2-1
2.17.3-1
2.17.5-1
2.17.5-2
2.17.5-3
2.17.5-4
2.17.5-5
2.18.0-1
2.18.0-2
2.18.1-1
2.18.1-2
2.18.1-3
2.18.1-4
2.18.3-1
2.19~pre20250506~462affa7c4-1
2.19~pre20250510~5347d4d4fc-1
2.19.0~beta1-1
2.19.0~beta1-2
2.19.0~beta2-1
2.19.0~beta4-1
2.19.0~beta5-1
2.19.0~beta6-1
2.19.0~rc2-1
2.19.0-1
2.19.1-1
2.19.2-1
2.19.3-1
2.19.3-2
2.19.4-1
2.20.1-1
2.20.3-1
2.21.0-1
2.21.1~rc1-1
2.21.1~rc1-2
2.21.2-1
2.22.0~beta1-1
2.22.0~beta2-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-123036.json"

Debian:13 / ansible-core

Package

Name
ansible-core
Purl
pkg:deb/debian/ansible-core?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

2.*
2.19.0~beta6-1
2.19.0~rc2-1
2.19.0-1
2.19.1-0+deb13u1
2.19.1-1
2.19.2-1
2.19.3-1
2.19.3-2
2.19.4-0+deb13u1
2.19.4-1
2.19.11-0+deb13u1
2.20.1-1
2.20.3-1
2.21.0-1
2.21.1~rc1-1
2.21.1~rc1-2
2.21.2-1
2.22.0~beta1-1
2.22.0~beta2-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-123036.json"

Debian:14 / ansible-core

Package

Name
ansible-core
Purl
pkg:deb/debian/ansible-core?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

2.*
2.19.0~beta6-1
2.19.0~rc2-1
2.19.0-1
2.19.1-1
2.19.2-1
2.19.3-1
2.19.3-2
2.19.4-1
2.20.1-1
2.20.3-1
2.21.0-1
2.21.1~rc1-1
2.21.1~rc1-2
2.21.2-1
2.22.0~beta1-1
2.22.0~beta2-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-123036.json"