{"id":"CVE-2026-1966","summary":"YugabyteDB Anywhere Exposes LDAP Credentials in Cleartext in Web UI","details":"YugabyteDB Anywhere displays LDAP bind passwords configured via gflags in cleartext within the web UI. An authenticated user with access to the configuration view could obtain LDAP credentials, potentially enabling unauthorized access to external directory services.","modified":"2026-08-12T15:31:31.070399Z","published":"2026-02-05T11:38:28.291Z","database_specific":{"unresolved_ranges":[{"extracted_events":[{"introduced":"2025.1.0.0"},{"fixed":"2025.1.1.0"}],"source":"AFFECTED_FIELD"}],"cna_assigner":"Yugabyte","cwe_ids":["CWE-522"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/1xxx/CVE-2026-1966.json"},"references":[{"type":"WEB","url":"https://docs.yugabyte.com/stable/secure/vulnerability-disclosure-policy/"},{"type":"WEB","url":"https://github.com/yugabyte/yugabyte-db/"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/1xxx/CVE-2026-1966.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1966"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/yugabyte/yugabyte-db","events":[{"introduced":"0585c935ab8ad2e61086448a45bc918c9019e6fd"},{"fixed":"4c17ce32154ed05079f5313a4cf3b744ad5e74a8"}],"database_specific":{"extracted_events":[{"introduced":"2024.2.0.0"},{"fixed":"2024.2.6.0"}],"source":"AFFECTED_FIELD"}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-1966.json","vanir_signatures_modified":"2026-08-12T15:31:31Z","vanir_signatures":[{"target":{"file":"java/yb-ysql-conn-mgr/src/test/java/org/yb/ysqlconnmgr/TestEnquote.java","function":"testEnquote"},"deprecated":false,"digest":{"length":2814,"function_hash":"337600428723717074017499924163479501254"},"id":"CVE-2026-1966-20f3785f","signature_type":"Function","signature_version":"v1","source":"https://github.com/yugabyte/yugabyte-db/commit/4c17ce32154ed05079f5313a4cf3b744ad5e74a8"},{"signature_version":"v1","source":"https://github.com/yugabyte/yugabyte-db/commit/4c17ce32154ed05079f5313a4cf3b744ad5e74a8","target":{"file":"src/odyssey/third_party/kiwi/kiwi/var.h","function":"kiwi_vars_cas"},"deprecated":false,"digest":{"function_hash":"179948618675293180613155698502977269206","length":1536},"id":"CVE-2026-1966-2d05f03c","signature_type":"Function"},{"digest":{"line_hashes":["175642241698264312483515968935189966768","40245755743177755776604146422830598628","222475090106648046575151977977693461404","242725893241259730872347629806028952433","113275242385585751738178565752064003718","194947689243604707350610308841478907690","136973795417218936124658893649415483400"],"threshold":0.9},"id":"CVE-2026-1966-9d5c1f0c","signature_type":"Line","signature_version":"v1","source":"https://github.com/yugabyte/yugabyte-db/commit/4c17ce32154ed05079f5313a4cf3b744ad5e74a8","target":{"file":"java/yb-ysql-conn-mgr/src/test/java/org/yb/ysqlconnmgr/TestEnquote.java"},"deprecated":false},{"source":"https://github.com/yugabyte/yugabyte-db/commit/4c17ce32154ed05079f5313a4cf3b744ad5e74a8","target":{"file":"java/yb-ysql-conn-mgr/src/test/java/org/yb/ysqlconnmgr/TestEnquote.java","function":"customizeMiniClusterBuilder"},"deprecated":false,"digest":{"function_hash":"97638338110788014445327403786247247325","length":63},"id":"CVE-2026-1966-bd7dd231","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/yugabyte/yugabyte-db/commit/4c17ce32154ed05079f5313a4cf3b744ad5e74a8","target":{"file":"src/odyssey/third_party/kiwi/kiwi/var.h"},"deprecated":false,"digest":{"line_hashes":["43030799941240351905895620426019372117","213777844762311795428380113013082482332","17075582522400435696373306995182048810","71405927037659252063753489484099108267","300241362081841736396048367105140460736","229916019444506453456622988793646615669","17183398649115371226873681268745094789"],"threshold":0.9},"id":"CVE-2026-1966-eae081ae","signature_type":"Line","signature_version":"v1"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:P/AC:H/AT:P/PR:H/UI:A/VC:L/VI:L/VA:L/SC:H/SI:H/SA:H"}]}