A flaw was found in insights-core where the password redaction layer fails to recognize credentials not keyed under the literal string 'password'. This allows SSSD LDAP bind passwords (ldap_default_authtok) and Pacemaker fence device credentials to be included in cleartext in archives uploaded to console.redhat.com.

Project Subscriptions

Vendors Products
Certifications Subscribe
Enterprise Linux Subscribe
Pdrive Lightspeed Subscribe
Satellite Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.


Workaround

Exclude sssd_config, sssd_conf_d, and cib_xml via /etc/insights-client/file-redaction.yaml, or add keyword/pattern redaction covering ldap_default_authtok and fence passwd/password XML forms, until a patched insights-core is available.

History

Tue, 11 Aug 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}


Tue, 11 Aug 2026 12:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

threat_severity

Moderate


Tue, 11 Aug 2026 06:45:00 +0000

Type Values Removed Values Added
Description A flaw was found in insights-core where the password redaction layer fails to recognize credentials not keyed under the literal string 'password'. This allows SSSD LDAP bind passwords (ldap_default_authtok) and Pacemaker fence device credentials to be included in cleartext in archives uploaded to console.redhat.com.
Title Insights-core: insights-core: incomplete credential redaction exposes sssd bind passwords and pacemaker fence credentials in uploaded archives
First Time appeared Redhat
Redhat certifications
Redhat enterprise Linux
Redhat pdrive Lightspeed
Redhat satellite
Weaknesses CWE-312
CPEs cpe:/a:redhat:certifications:9
cpe:/a:redhat:pdrive_lightspeed:0
cpe:/a:redhat:pdrive_lightspeed:1
cpe:/a:redhat:satellite:6
cpe:/o:redhat:enterprise_linux:10
cpe:/o:redhat:enterprise_linux:9
Vendors & Products Redhat
Redhat certifications
Redhat enterprise Linux
Redhat pdrive Lightspeed
Redhat satellite
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}


Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2026-08-11T13:23:45.771Z

Reserved: 2026-08-10T03:40:39.898Z

Link: CVE-2026-19391

cve-icon Vulnrichment

Updated: 2026-08-11T13:23:32.045Z

cve-icon NVD

Status : Received

Published: 2026-08-11T07:17:29.347

Modified: 2026-08-11T07:17:29.347

Link: CVE-2026-19391

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-08-08T00:00:00Z

Links: CVE-2026-19391 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-11T08:00:03Z

Weaknesses