Impact

• API Key and Secret were logged when using api_credential_file

• WireGuard private_key and psk were logged

Depending on your Ansible-logging configuration and plugins (p.e. Ansible-ARA) these secrets might be visible in plaintext.

Patches

Upgrade to Version 1.2.13 or latest

If you provided your API-credentials and/or WireGuard keys this way - we recommend you to rotate them!

Workarounds

• Do not use api_credential_file to provide your API-credentials to the collection's modules

References

See:

• #187
• #189

More Information about Ansible Logging: https://docs.ansible.com/ansible/latest/reference_appendices/logging.html

Thanks to @alteriks for reporting these issues!