CVE-2026-19391CWE-312

CVE-2026-19391

Medium · published August 11, 2026

CVSS v3.1

6.5

EPSS

Percentile

14.6

In the wild

Unconfirmed

What it is

A flaw was found in insights-core where the password redaction layer fails to recognize credentials not keyed under the literal string 'password'. This allows SSSD LDAP bind passwords (ldap_default_authtok) and Pacemaker fence device credentials to be included in cleartext in archives uploaded to console.redhat.com.

The record

Technical detail

CVSS v3.1: 6.5 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0: Not supplied
EPSS: 0.00243 · 14.6th percentile
Weakness: CWE-312 · Cleartext Storage of Sensitive Information
Published: 2026-08-11T11:17Z

References (2)

https://access.redhat.com/security/cve/CVE-2026-19391 · [email protected]https://bugzilla.redhat.com/show_bug.cgi?id=2513020 · [email protected]

EPSS history

Timeline

11 AUG 06:25Z
Insights-core: insights-core: incomplete credential redaction exposes sssd bind passwords and pacemaker fence credentials in uploaded archives
cvelistv5