CVE-2026-16566
CVE-2026-16566: 1 tracked advisory record across Red Hat. Compare source-reported impact, fixes and remediation.
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
Vendor advisory comparison
Red Hat
1 advisory- Advisory severityMedium6.1
Medium [CVE-2026-16566] jenkins_credential module returns generated API token in plaintext output
CVE-2026-16566Source published Source updated
A flaw was found in the community.general Ansible collection's jenkins_credential module. When creating a Jenkins API token (credential_type: token), the module correctly protects the input password with no_log=True in the argument specification, but places the generated API token returned by the Jenkins API directly into the Ansible task result dictionary without output suppression. The token is emitted in plaintext via exit_json(), causing it to appear in Ansible task output, AWX/Tower/AAP Controller job logs, callback plugin output, CI/CD pipeline logs, and fact caching backends. An attacker with access to any of these output channels can obtain the Jenkins API token and gain the same privileges as the user who created it. Red Hat severity: Moderate — CVSS 6.1…
- Affected products in this advisory
- No product details extracted. Check the source bulletin.
- Source-reported affected versions
- Affected-version details not available in this record.
- Source-reported fixed versions
- No fixed-version detail extracted. This does not mean no fix exists.
- Mitigation guidance
- - Add no_log: true at the task level when using the jenkins_credential module with credential_type: token: - name: Create Jenkins API token community.general.jenkins_credential: credential_type: token jenkins_url: "{{ jenkins_url }}" jenkins_user: "{{ jenkins_user }}" jenkins_password: "{{ jenkins_password }}" register: token_result no_log: true - Review AWX/Tower/AAP Controller job logs, CI/CD pipeline logs, and callback plugin output for any previously leaked Jenkins API tokens. Rotate any tokens found in logs. - If fact caching is enabled, check the cache backend for registered variables containing jenkins_credential results.
Android app · Google Play
Monitor future Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.