CVE-2026-16566
Description
A flaw was found in the community.general Ansible collection's jenkins_credential module. When creating a Jenkins API token (credential_type: token), the module correctly protects the input password with no_log=True in the argument specification, but places the generated API token returned by the Jenkins API directly into the Ansible task result dictionary without output suppression. The token is emitted in plaintext via exit_json(), causing it to appear in Ansible task output, AWX/Tower/AAP Controller job logs, callback plugin output, CI/CD pipeline logs, and fact caching backends. An attacker with access to any of these output channels can obtain the Jenkins API token and gain the same privileges as the user who created it.
Mitigation
- Add no_log: true at the task level when using the jenkins_credential
module with credential_type: token:
- name: Create Jenkins API token
community.general.jenkins_credential:
credential_type: token
jenkins_url: "{{ jenkins_url }}"
jenkins_user: "{{ jenkins_user }}"
jenkins_password: "{{ jenkins_password }}"
register: token_result
no_log: true
- Review AWX/Tower/AAP Controller job logs, CI/CD pipeline logs,
and callback plugin output for any previously leaked Jenkins API
tokens. Rotate any tokens found in logs.
- If fact caching is enabled, check the cache backend for registered
variables containing jenkins_credential results.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.1 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | High | N/A | N/A |
| Integrity Impact | Low | N/A | N/A |
| Availability Impact | None | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Acknowledgements
Red Hat would like to thank Bipin Saud (okBoss https://www.linkedin.com/in/bipinsaud) for reporting this issue.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
