---
id: CVE-2026-11819
title: >-
  Module: plugins/modules/keyring_info.py 


  CVSS 3.1: 5.5 MEDIUM — AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N 


  Issue: The module retrieves a passphrase from the OS native keyring (GNOME
  Keyring, macOS Keychain, Windows Credential Manager) and pl…
summary: >-
  Module: plugins/modules/keyring_info.py 


  CVSS 3.1: 5.5 MEDIUM — AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N 


  Issue: The module retrieves a passphrase from the OS native keyring (GNOME
  Keyring, macOS Keychain, Windows Credential Manager) and pl…
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-532
vendor: redhat
product: enterprise_linux
affected:
  - enterprise_linux = 10.0
published: '2026-06-23'
updated: '2026-08-31'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-11819'
references:
  - url: 'https://access.redhat.com/security/cve/CVE-2026-11819'
    label: secalert@redhat.com
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2487251'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/security/cve/cve-2026-11819'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.00161
epssPercentile: 0.04546
ingestedAt: '2026-08-31T13:08:32.195Z'
---

## Overview

Module: plugins/modules/keyring_info.py 

CVSS 3.1: 5.5 MEDIUM — AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N 

Issue: The module retrieves a passphrase from the OS native keyring (GNOME Keyring, macOS Keychain, Windows Credential Manager) and places it directly into result["passphrase"] with no output suppression, no no_log protection, and no documentation warning. 

Root Cause:

Line 105 (protected): keyring_password=dict(type="str", required=True, no_log=True)
Line 127 (NOT protected): result["passphrase"] = passphrase

Observed Output:

{
"changed": false,
"passphrase": "MyMasterP@ssw0rd!SSH_Key_Secret"
}
Visible via register + debug:
{
"keyring_result": {
"changed": false,
"passphrase": "MyMasterP@ssw0rd!SSH_Key_Secret"
}
}

Impact: 

Master passwords, SSH key passphrases and service credentials appear in all Ansible output 

register: keyring_result followed by debug: var=keyring_result prints passphrase in full 

Ansible fact caching backends (Redis, JSON file, memcached) may persist the passphrase 

AWX/Tower job logs silently store the live credential

Fix:

module.exit_json(changed=False, passphrase=passphrase, _ansible_no_log=True)

Also add a documentation warning requiring callers to use no_log: true at the task level.

PoCs


Fig 1: PoC execution showing passphrase in plaintext output


Fig 2: Source code showing no_log=True on input (line 105) vs unprotected output (line 127)

## Affected

- `enterprise_linux = 10.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.