mirror of
https://github.com/netbirdio/ansible-netbird.git
synced 2026-05-22 18:43:36 -07:00
Jack Carter
0ae9f8c657
The three ansible.builtin.uri tasks in the export and configure roles interpolate the PAT directly into the Authorization header. Under -vvvv (or any inspection of the registered result), Ansible prints the rendered task args dict including those headers, leaking the bearer token in cleartext. The remaining API calls in both roles go through community.ansible_netbird.netbird_info, which already masks the token. The three bare uri tasks were the only leak surface in the roles. Adding no_log: true suppresses the rendered task args and the registered response. loop_control.label is exempt from no_log, so the per-iteration "name" still prints for progress visibility. Detected by a token-leak audit that decrypts the vault and greps for the actual token values across smoke + invariant runs under -vvvv on both self-hosted and Cloud environments. Before this change, the audit flagged 2 occurrences per invariant run; after, 0. Fixes 3 leak sites: - roles/export/tasks/main.yml: "Fetch routers for each network" - roles/export/tasks/main.yml: "Fetch resources for each network" - roles/configure/tasks/main.yml: "Fetch routers for each network (preview diff)"