Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-1966: YugabyteDB Anywhere shows LDAP passwords in cleartext on UI

CVE-2026-1966 · published 9 months ago

Summary

YugabyteDB Anywhere’s web interface reveals the LDAP bind passwords that are set through configuration flags. Anyone who can log into the system and view the configuration page can read those passwords and could use them to access the organization’s directory service. Review the settings, restrict configuration‑view access, change the exposed passwords, and apply the vendor’s update that hides this information.

Original advisory text

YugabyteDB Anywhere Exposes LDAP Credentials in Cleartext in Web UI

YugabyteDB Anywhere displays LDAP bind passwords configured via gflags in cleartext within the web UI. An authenticated user with access to the configuration view could obtain LDAP credentials, potentially enabling unauthorized access to external directory services.

References

https://docs.yugabyte.com/stable/secure/vulnerability-disclosure-policy/ URL
https://github.com/yugabyte/yugabyte-db/ URL
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/1xxx/CVE-2026-1966.j... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-1966 Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

5.9 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-522Insufficiently Protected Credentials

Timeline

Published5 Feb 2026

Updated1 Nov 2026

First seen6 Mar 2026

Sources

CVE-2026-1966 · NVD

CVE-2026-1966 · OSV

Track software like this

Free during beta