The community.general Ansible collection’s jenkins_credential module, when generating a Jenkins API token, fails to suppress the token in the task result dictionary. As a result, the secret appears in plaintext within Ansible’s normal output, AWX/Tower/AAP Controller logs, callback plugins, CI/CD pipeline logs, and fact caching backends. An attacker who can read any of these channels can capture the token and authenticate to Jenkins with the same privileges as the user who created the token, enabling unauthorized actions or further exploitation within the Jenkins environment.

All installations of the community.general collection that include the jenkins_credential module are susceptible. The exact collection versions are not specified in the advisory, so all released versions remain potentially affected until a fix is distributed.

The CVSS score of 6.1 indicates moderate severity. The EPSS score is not available, so the likelihood of exploitation cannot be quantified precisely, but the vulnerability is listed as not in CISA KEV, indicating no widespread, actively exploited instances are reported. Exploitation requires access to the Ansible output channels; if an attacker can view job logs or controller output, they can retrieve the token. The advisory does not provide a workaround, so interim mitigation relies on restricting log access or altering the module to suppress secrets.