CVE-2026-1966CWE-522

YugabyteDB Anywhere Exposes LDAP Credentials in Cleartext in Web UI

Low · published February 5, 2026

CVSS v4.0
2.4
EPSS
0%
Percentile
7.5
In the wild
Unconfirmed
What it is

YugabyteDB Anywhere displays LDAP bind passwords configured via gflags in cleartext within the web UI. An authenticated user with access to the configuration view could obtain LDAP credentials, potentially enabling unauthorized access to external directory services.

The record
Technical detail
CVSS v4.0
2.4 · LOW
Vector
CVSS:4.0/AV:P/AC:H/AT:P/PR:H/UI:A/VC:L/VI:L/VA:L/SC:H/SI:H/SA:H
EPSS
0.00184 · 7.5th percentile
Weakness
CWE-522 · Insufficiently Protected Credentials
Published
2026-02-05T11:38Z
EPSS history
Timeline
  • 05 FEB 11:38Z
    YugabyteDB Anywhere Exposes LDAP Credentials in Cleartext in Web UI
    cvelistv5