CVE-2026-16566

{}

{}

{}

{"acknowledgement": "Red Hat would like to thank Bipin Saud (okBoss https://www.linkedin.com/in/bipinsaud) for reporting this issue.", "bugzilla": {"description": "community.general: community.general: jenkins_credential module returns generated API token in plaintext output", "id": "2506113", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2506113"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.1", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "status": "draft"}, "details": ["A flaw was found in the community.general Ansible collection's\njenkins_credential module. When creating a Jenkins API token\n(credential_type: token), the module correctly protects the input\npassword with no_log=True in the argument specification, but places\nthe generated API token returned by the Jenkins API directly into\nthe Ansible task result dictionary without output suppression. The\ntoken is emitted in plaintext via exit_json(), causing it to appear\nin Ansible task output, AWX/Tower/AAP Controller job logs, callback\nplugin output, CI/CD pipeline logs, and fact caching backends. An\nattacker with access to any of these output channels can obtain the\nJenkins API token and gain the same privileges as the user who\ncreated it."], "mitigation": {"lang": "en:us", "value": "- Add no_log: true at the task level when using the jenkins_credential\nmodule with credential_type: token:\n- name: Create Jenkins API token\ncommunity.general.jenkins_credential:\ncredential_type: token\njenkins_url: \"{{ jenkins_url }}\"\njenkins_user: \"{{ jenkins_user }}\"\njenkins_password: \"{{ jenkins_password }}\"\nregister: token_result\nno_log: true\n- Review AWX/Tower/AAP Controller job logs, CI/CD pipeline logs,\nand callback plugin output for any previously leaked Jenkins API\ntokens. Rotate any tokens found in logs.\n- If fact caching is enabled, check the cache backend for registered\nvariables containing jenkins_credential results."}, "name": "CVE-2026-16566", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "rhel-system-roles", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "rhc-worker-playbook", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "rhel-system-roles", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "rhel-system-roles", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-07-22T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-16566\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-16566"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "product": "credentials", "vendor": "jenkins"}], "created": "2026-07-27T05:00:04.764716+00:00", "updated": "2026-08-04T19:45:03.523211+00:00", "vendors": ["jenkins", "jenkins$PRODUCT$credentials"], "weaknesses": ["CWE-200"]}