# CVE-2026-123036: CVE-2026-123036

Status: published. Published: 2026-11-05. Updated: 2026-11-05.

A flaw was found in ansible-core. When a task marked `no_log: true` fails, the task result is censored before being emitted, but the `exception` field is retained because it is present in the PRESERVE allow-list in lib/ansible/_internal/_task.py, and the default stdout callback prints it through CallbackBase._handle_exception. As a result, sensitive values the operator explicitly asked to hide can be disclosed: module argument-validation errors echo the argument value, templating errors print an Origin source snippet (the failing line plus the two preceding lines of the variables file, exposing neighbouring secrets from an -e @secrets.yml file), and fail/assert messages are printed in full. Secret material supplied as extra variables or variables files can therefore leak to terminal output, CI logs, and the stdout logs of any automation wrapping ansible-playbook, even though every task touching the secrets is marked no_log: true. This is a regression introduced with the ansible-core 2.19 data-tagging/templating rework; the behaviour does not occur on 2.16, where the error text is correctly censored.

## Remediation

No remediation reported in collected sources

## Affected products and versions

- Red Hat / ansible-core (ansible-core): ≥ 2.19.0; < 2.23.0 (affected, semver). Source: CNA: redhat

## Severity and prioritization

- CVSS 3.1: 5.5 (medium); CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N; source: CNA: redhat

- CVSS 3.1: 5.5 (medium); CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N; source: NVD: secalert@redhat.com

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: Not available

- Weaknesses: CWE-209

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://access.redhat.com/security/cve/CVE-2026-123036 (CNA: redhat)

- https://access.redhat.com/security/cve/CVE-2026-123036 (secalert@redhat.com)

## Provenance

- CNA: redhat: https://www.cve.org/CVERecord?id=CVE-2026-123036; retrieved 2026-11-05; source updated 2026-11-05

- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-123036; retrieved 2026-11-05; source updated 2026-11-05

Revision: 9f95bdc3bff2e2f14fa7bee29a8b5de6454116d1e1c894bc28449431ae0cad13

Canonical: https://y2.dev/cve/CVE-2026-123036

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.