The ipa_getkeytab module in the community.general Ansible collection accepts an LDAP bind password through its bind_pw parameter, but this parameter is not flagged with no_log. As a result the cleartext password is written to the managed host’s system journal or syslog as part of the module’s invoked with record, is included in the module’s return values and visible in verbose (-v) output, and is displayed in Automation Controller/AWX job logs. Additionally the helper command ipa-getkeytab receives the plain password via a command-line argument, exposing it in the process table for the duration of execution. An adversary who can read these logs, job output, or enumerate running processes can obtain the directory bind credential and therefore compromise any accounts or objects accessible with that credential.

Red Hat Ceph Storage 5, Red Hat Ceph Storage 9, Red Hat OpenStack Platform 17.1, and Red Hat OpenStack Platform 18.0 are affected by this flaw.

The vulnerability carries a CVSS score of 5.5, indicating medium severity, and its EPSS score is not available while it is not listed in the CISA KEV catalog. Likely exploitation requires local access to the target machine's log files or the ability to view the process list during module execution; it could also be leveraged through job output accessed by unprivileged users in AWX or Automation Controller if role‑based access controls are insufficient. The combined factors point to a moderate risk of credential compromise.