CVE-2026-1966: YugabyteDB Anywhere Exposes LDAP Credentials in Cleartext in Web UI
YugabyteDB Anywhere displays LDAP bind passwords configured via gflags in cleartext within the web UI. An authenticated user with access to the configuration view could obtain LDAP credentials, potentially enabling unauthorized access to external directory services.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-1966?
CVE-2026-1966 is considered a high-severity vulnerability due to the exposure of LDAP credentials in cleartext.
How do I fix CVE-2026-1966?
To fix CVE-2026-1966, securely configure your YugabyteDB Anywhere to prevent LDAP credentials from being displayed in cleartext.
Who is affected by CVE-2026-1966?
CVE-2026-1966 affects all users of YugabyteDB Anywhere that have configured LDAP bind passwords through the web UI.
What could happen if CVE-2026-1966 is exploited?
If CVE-2026-1966 is exploited, unauthorized users could gain access to LDAP credentials, potentially leading to unauthorized access.
Is there a workaround for CVE-2026-1966?
Currently, the best workaround for CVE-2026-1966 is to limit access to the configuration view in the web UI to authorized users only.