diff --git a/cinder/tests/unit/test_utils.py b/cinder/tests/unit/test_utils.py
index 55578dad85e..2b6921d5c2f 100644
--- a/cinder/tests/unit/test_utils.py
+++ b/cinder/tests/unit/test_utils.py
@@ -1359,6 +1359,29 @@ class LogTracingTestCase(test.TestCase):
         self.assertIn("'adminPass': '***'",
                       str(mock_log.debug.call_args_list[1]))
 
+    def test_utils_trace_method_with_password_in_formal_params(self):
+        mock_logging = self.mock_object(utils, 'logging')
+        mock_log = mock.Mock()
+        mock_log.isEnabledFor = lambda x: True
+        mock_logging.getLogger = mock.Mock(return_value=mock_log)
+
+        @utils.trace
+        def _trace_test_method(*args, **kwargs):
+            self.assertEqual('verybadpass',
+                             kwargs['test_args']['data']['password'])
+            pass
+
+        test_args = {
+            'data': {
+                'password': 'verybadpass'
+            }
+        }
+        _trace_test_method(self, test_args=test_args)
+
+        self.assertEqual(2, mock_log.debug.call_count)
+        self.assertIn("'password': '***'",
+                      str(mock_log.debug.call_args_list[0]))
+
     @ddt.data(
         {'total': 30.01, 'free': 28.01, 'provisioned': 2.0, 'max_ratio': 1.0,
          'thin_support': False, 'thick_support': True,
diff --git a/cinder/utils.py b/cinder/utils.py
index e78c09805b4..ee0e590fd20 100644
--- a/cinder/utils.py
+++ b/cinder/utils.py
@@ -911,7 +911,9 @@ def trace(*dec_args, **dec_kwargs):
 
             if pass_filter:
                 logger.debug('==> %(func)s: call %(all_args)r',
-                             {'func': func_name, 'all_args': all_args})
+                             {'func': func_name,
+                              'all_args': strutils.mask_password(
+                                  six.text_type(all_args))})
 
             start_time = time.time() * 1000
             try: