EUVD-2026-55951
GHSA-2pq5-gq5q-3g2p
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Archive access requires authenticated console.redhat.com session (PR:L, AV:N); pure credential disclosure with no integrity or availability impact.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in insights-core where the password redaction layer fails to recognize credentials not keyed under the literal string 'password'. This allows SSSD LDAP bind passwords (ldap_default_authtok) and Pacemaker fence device credentials to be included in cleartext in archives uploaded to console.redhat.com.
AnalysisAI
Cleartext credential exposure in Red Hat insights-core allows SSSD LDAP bind passwords (ldap_default_authtok) and Pacemaker fence device credentials to be included unredacted in diagnostic archives uploaded to console.redhat.com. The redaction layer uses a naive string-match on the literal key name 'password', leaving non-standard credential field names - such as those used by SSSD and Pacemaker - completely unprotected before archive upload. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following to be true simultaneously: (1) the target system is enrolled in Red Hat Insights and performing archive uploads to console.redhat.com; (2) SSSD is configured with ldap_default_authtok for LDAP simple bind authentication, OR Pacemaker fence devices are configured with password-type credentials in their agent configuration; (3) the attacker has authenticated access to the organization's archive store on console.redhat.com (CVSS PR:L confirms authenticated access is required - unauthenticated exploitation is not applicable). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 6.5 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N correctly characterizes this as a network-accessible, low-complexity credential disclosure. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has compromised or legitimately holds an account on console.redhat.com with access to an organization's Insights data downloads a historical or current diagnostic archive from an enrolled RHEL system running SSSD with LDAP simple bind. The archive contains the ldap_default_authtok value in cleartext because the redaction filter never matched the non-standard field name. … |
| Remediation | Apply the vendor-released patch per the Red Hat security advisory at https://access.redhat.com/security/cve/CVE-2026-19391; no specific fix version number is confirmed in the available data, so monitor the advisory and the Bugzilla entry at https://bugzilla.redhat.com/show_bug.cgi?id=2513020 for patch availability. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Privilege escalation in Red Hat OpenShift's incluster-checks diagnostic tool lets any authenticated user holding the sta
Command injection in the rpmuncompress utility of RPM allows local attackers to execute arbitrary commands when a victim
Same weakness CWE-312 – Cleartext Storage of Sensitive Information
View allSame technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today