CVE-2026-1966 — YugabyteDB Anywhere Exposes LDAP Credentials in Cleartext in Web UI

CVE-2026-1966

YugabyteDB Anywhere Exposes LDAP Credentials in Cleartext in Web UI PUBLISHED

Description (CNA)

YugabyteDB Anywhere displays LDAP bind passwords configured via gflags in cleartext within the web UI. An authenticated user with access to the configuration view could obtain LDAP credentials, potentially enabling unauthorized access to external directory services.

Affected (CNA)

Vendor / product	Versions
YugabyteDB Inc / YugabyteDB Anywhere	affected 2025.1.0.0 before 2025.1.1.0; affected 2024.2.0.0 before 2024.2.6.0; unaffected 2025.2.0.0

CWE

CWE-522

References

https://docs.yugabyte.com/stable/secure/vulnerability-disclosure-policy/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.