CVE-2026-19391Medium· 6.5▾ SunlitA flaw was found in insights-core where the password redaction layer fails to recognize credentials not keyed under the literal string 'password'. This allows SSSD LDAP bind passwords (ldap_default_authtok) and Pacemaker fence device cre…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Nov 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.2%
A flaw was found in insights-core where the password redaction layer fails to recognize credentials not keyed under the literal string 'password'. This allows SSSD LDAP bind passwords (ldap_default_authtok) and Pacemaker fence device credentials to be included in cleartext in archives uploaded to console.redhat.com.
pen-drive/pen-drive-scanner-rhel9 (all versions)pen-drive/pen-drive-scanner-rhel9 (all versions)rhcertification/redhat-certification-cloud-10 (all versions)rhcertification/redhat-certification-cloud-9 (all versions)insights-core (all versions)rhel10-eus/rhel-10.2-bootc (all versions)rhel10/rhel-bootc (all versions)insights-core (all versions)satellite/iop-advisor-engine-rhel9satellite/iop-insights-engine-rhel9satellite/iop-puptoo-rhel9satellite/iop-yuptoo-rhel9Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Exclude sssd_config, sssd_conf_d, and cib_xml via /etc/insights-client/file-redaction.yaml, or add keyword/pattern redaction covering ldap_default_authtok and fence passwd/password XML forms, until a patched insights-core is available.
Connected by shared product, vendor, weakness, or advisory.
CVE-2024-7259Medium· 4.9Ovirt-engine: potential exposure of cleartext provider passwords via web ui
CVE-2024-4540High· 7.5A flaw was found in Keycloak in OAuth 2.0 Pushed Authorization Requests (PAR)
CVE-2026-13505High· 7.5org.bouncycastle/bc-fips: Bouncy Castle for Java FIPS: Sensitive key material remains in memory due to delayed zeroisation (CVE-2026-13505)
CVE-2026-73834Medium· 5.5A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes
CVE-2026-120984Critical· 9.1Keycloak-services: keycloak-services: manage-clients to arbitrary code execution through inline javascript policy import
CVE-2026-83495NoneTrainer: trainer: trainjob env passthrough enables valuefrom.secretkeyref injection for namespace secret exfiltration