CVE-2026-1966

YugabyteDB Anywhere Exposes LDAP Credentials in Cleartext in Web UI

State: Published
Severity: 2.4 Low
Published: Feb 5, 2026
Updated: Feb 5, 2026
Reserved: Feb 5, 2026

Description

YugabyteDB Anywhere displays LDAP bind passwords configured via gflags in cleartext within the web UI. An authenticated user with access to the configuration view could obtain LDAP credentials, potentially enabling unauthorized access to external directory services.

Scores

CVSS	Score	Vector	Source
4.0	2.4 Low	CVSS:4.0/AV:P/AC:H/AT:P/PR:H/UI:A/VC:L/VI:L/VA:L/SC:H/SI:H/SA:H	Yugabyte

Weaknesses

CWE-522 Insufficiently Protected Credentials

Affected Products

Product	Versions
YugabyteDB AnywhereYugabyteDB Inc	2025.1.0.0 to before 2025.1.1.0Affected 2024.2.0.0 to before 2024.2.6.0Affected 2025.2.0.0Not affected

References

https://docs.yugabyte.com/stable/secure/vulnerability-disclosure-policy/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.