VulnerabilityDeferred

CVE-2026-1966

An authenticated user with access to the configuration view could obtain LDAP credentials, potentially enabling unauthorized access to external directory services.

LOW 2.4EPSS 0.17%

Does this matter?

Lower severity and a low EPSS score (0.17%). Track it; it rarely justifies an emergency change on its own.

Description

YugabyteDB Anywhere displays LDAP bind passwords configured via gflags in cleartext within the web UI. An authenticated user with access to the configuration view could obtain LDAP credentials, potentially enabling unauthorized access to external directory services.

CVSS 4.0: 2.4 LOWCVSS:4.0/AV:P/AC:H/AT:P/PR:H/UI:A/VC:L/VI:L/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.17% probability · 7th percentile
CISA KEV: Not listed
Weakness: CWE-522
Source: security@yugabyte.com

References

https://docs.yugabyte.com/stable/secure/vulnerability-disclosure-policy/

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.