insights-core CVE-2026-19391

Exploitation requires all of the following to be true simultaneously: (1) the target system is enrolled in Red Hat Insights and performing archive uploads to console.redhat.com; (2) SSSD is configured with ldap_default_authtok for LDAP simple bind authentication, OR Pacemaker fence devices are configured with password-type credentials in their agent configuration; (3) the attacker has authenticated access to the organization's archive store on console.redhat.com (CVSS PR:L confirms authenticated access is required - unauthenticated exploitation is not applicable). Limiting factors: systems using Kerberos/GSSAPI LDAP authentication (no ldap_default_authtok present), SSH-keyed Pacemaker fencing, or systems with Insights uploads disabled are not exposed to credential leakage. The vulnerability does not enable direct remote code execution or unauthenticated network access - the attacker must already hold console.redhat.com credentials for the target organization.

CVSS 6.5 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N correctly characterizes this as a network-accessible, low-complexity credential disclosure. C:H is well-justified because exposed LDAP bind passwords or fence device credentials can grant full directory or cluster management access. PR:L reflects that an attacker must hold authenticated access to the target organization's Red Hat Insights console on console.redhat.com to retrieve the archive - this is the primary mitigating factor. EPSS data was not provided; exploitation probability cannot be quantified from available data. The vulnerability is not listed in CISA KEV and no POC has been identified, meaning it remains a theoretical privilege escalation path rather than a confirmed active threat. Real-world risk is elevated for organizations where LDAP simple bind is in use with SSSD and Insights uploads are enabled, since the exposed LDAP bind password may grant broad directory read/write access. For organizations using Kerberos/GSSAPI or SSH-based Pacemaker fencing, exposure is limited or absent.

An attacker who has compromised or legitimately holds an account on console.redhat.com with access to an organization's Insights data downloads a historical or current diagnostic archive from an enrolled RHEL system running SSSD with LDAP simple bind. The archive contains the ldap_default_authtok value in cleartext because the redaction filter never matched the non-standard field name. The attacker uses the recovered LDAP bind credential to authenticate to the corporate LDAP directory and enumerate or exfiltrate user account data, or pivots to Pacemaker cluster management if fence device credentials were captured.