community.general ipa_getkeytab: IPA/LDAP bind password written to logs and exposed in the process list

Impact

The module's bind_pw parameter is not marked no_log, unlike the sibling password parameter, so the IPA/LDAP simple-bind password lands in cleartext in the managed host's journal or syslog as part of the module's "Invoked with" record, in the module return values and -v output, and in Automation Controller / AWX job output. It is also passed to the ipa-getkeytab helper as --bindpw on the command line, so it is visible in the process table to any local user for the duration of the run. On a fleet where Ansible enrolls nodes into a directory, that single credential typically has enough directory rights to read or create service principals across the estate. Anyone who can read node logs, the AWX job history, or run ps on a managed host during a play collects it without needing any exploit.

Who can reach it

A local user on a managed host who can read the system journal or the process table while the play runs, or any user with read access to Automation Controller / AWX job output. No authentication to the directory itself is needed - the credential is handed over.

What to do

The record carries no fixed collection version, only the Red Hat tracking entries, so treat this as mitigate-first: avoid bind_pw in favour of the module's password parameter or a keytab-based bind, wrap invocations with no_log: true on the task, and pass the value from a vault rather than inline. Then rotate the bind credential and purge it from journals, syslog archives and stored AWX job output, because the exposure is retrospective - patching later does not unpublish a password already written to logs.

References

Related entries

• Harbor (audit log redaction, LDAP password and OIDC client secret): CREDENTIAL DISCLOSURE VIA THE AUDIT TRAIL: HarborNCVD-2026-058-harbor-audit-log-redaction-ldap · Harbor (audit log redaction, LDAP password and OIDC client secret)Medium
• Kubeflow (central dashboard, reflected cross-site scripting): Reflected XSS in the Kubeflow dashboard runs attackerCVE-2023-6571 · Kubeflow (central dashboard, reflected cross-site scripting)Medium
• LibreNMS: reflected XSS in the Proxmox view runs script in a logged-in monitoring user's sessionCVE-2026-45694 · LibreNMS (Proxmox application view, instance and vmid parameters)Medium
• CloudNativePG instance manager (status server, TCP/8000 control endpoints): A set of operator-only control endpointsNCVD-2026-050-cloudnativepg-instance-manager-s · CloudNativePG instance manager (status server, TCP/8000 control endpoints)Medium
• Slurm (user_name / gid field handling): Slurm trusts the user_name and gid fields carried in job RPCs instead ofCVE-2018-10995 · Slurm (user_name / gid field handling)Medium
• IBM Spectrum LSF (job submission, file permissions): Weak file permissions in the LSF install let a local user changeCVE-2018-1724 · IBM Spectrum LSF (job submission, file permissions)Medium