CVE-2026-19391: Insights-core: insights-core: incomplete credential redaction exposes sssd bind passwords and pacemaker fence credentials in uploaded archives
A flaw was found in insights-core where the password redaction layer fails to recognize credentials not keyed under the literal string 'password'. This allows SSSD LDAP bind passwords (ldapdefaultauthtok) and Pacemaker fence device credentials to be included in cleartext in archives uploaded to console.redhat.com.
Other sources
A flaw was found in insights-core. The password redaction layer in insights/cleaner/password.py only recognizes credentials keyed under the literal string 'password'. SSSD's ldapdefaultauthtok and Pacemaker CIB fence device credentials stored as XML attributes (name="passwd" value="...") bypass the redaction entirely. Because the sssdconfig, sssdconfd, and cibxml specs are not declared filterable, the full file contents pass through the cleaner unmodified, and these credentials are included in cleartext in archives uploaded to console.redhat.com. This allows anyone with access to the uploaded archives to read LDAP bind passwords and cluster fence device credentials (IPMI, iLO, DRAC, vCenter). The default insights-client configuration is affected with no non-default settings required.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-19391?
CVE-2026-19391 has a medium severity score of 6.5.
How do I fix CVE-2026-19391?
To fix CVE-2026-19391, apply the latest updates or patches provided by your software vendor.
What credentials are exposed by CVE-2026-19391?
CVE-2026-19391 exposes SSSD LDAP bind passwords and Pacemaker fence device credentials in cleartext.
What impact does CVE-2026-19391 have on systems?
CVE-2026-19391 can lead to unauthorized access due to the exposure of sensitive credentials.
Is CVE-2026-19391 specific to any software?
CVE-2026-19391 specifically affects insights-core software.