CVE-2026-1966: low-severity vulnerability in YugabyteDB Anywhere
YugabyteDB Anywhere Exposes LDAP Credentials in Cleartext in Web UI
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
8Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 2.4epss 0.2%
YugabyteDB Anywhere displays LDAP bind passwords configured via gflags in cleartext within the web UI. An authenticated user with access to the configuration view could obtain LDAP credentials, potentially enabling unauthorized access to external directory services.
CVSS:4.0/AV:P/AC:H/AT:P/PR:H/UI:A/VC:L/VI:L/VA:L/SC:H/SI:H/SA:H
Affected products
YugabyteDB Inc · YugabyteDB AnywhereRelated CVEs — YugabyteDB Anywhere
In the same product, most dangerous first.