---
id: CVE-2026-11820
title: >-
  Community.general: community.general nexmo — api credentials exposed in get
  url query string[security] community.general nexmo — api credentials exposed
  in get url query string
summary: |-
  A flaw was found in the community.general Ansible collection's nexmo module.
  The module constructs HTTP requests to the Vonage/Nexmo SMS API by encoding
  API credentials (api_key and api_secret) into URL query parameters and
  sending them …
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-532
vendor: Red Hat
product: rhel-system-roles
affected:
  - rhel-system-roles
  - rhc-worker-playbook
  - rhel-system-roles
  - rhel-system-roles
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-06-24T12:39:10.319686Z'
published: '2026-06-23'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T16:22:45.588Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-11820'
references:
  - url: 'https://access.redhat.com/security/cve/CVE-2026-11820'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2488970'
    label: RHBZ#2488970
tags:
  - cve.org
epss: 0.00394
epssPercentile: 0.3381
ingestedAt: '2026-11-05T22:38:31.345Z'
---

## Overview

A flaw was found in the community.general Ansible collection's nexmo module.
The module constructs HTTP requests to the Vonage/Nexmo SMS API by encoding
API credentials (api_key and api_secret) into URL query parameters and
sending them via GET requests. This causes credentials to be exposed in web
server access logs, proxy logs, HTTP Referer headers, and network monitoring
tools, despite the Ansible argument specification marking these parameters
as no_log. An attacker with access to any of these logging or monitoring
points can obtain the full API credentials and gain unauthorized access to
the victim's Vonage/Nexmo account.

## Affected

- `rhel-system-roles`
- `rhc-worker-playbook`
- `rhel-system-roles`
- `rhel-system-roles`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

The following practices would help for avoiding exposure and mitigate this
flaw:
- If possible, stop using the community.general nexmo module entirely. It is
  deprecated upstream and was removed in community.general 9.0.0. Consider
  using the Vonage API directly via the community.general uri module with
  POST method and credentials in the request body.
- Review web server, proxy, and load balancer access logs for any recorded
  Vonage API URLs containing api_key and api_secret parameters. Rotate any
  credentials found in logs.
- Restrict access to HTTP access logs on systems where the nexmo module has
  been used.
- Configure proxy and web server logging to redact or exclude query string
  parameters from URL logging where possible.