libvirt before 1.2.12 allow remote authenticated users to obtain the VNC password by using the VIRDOMAINXML_SECURE flag with a crafted (1) snapshot to the virDomainSnapshotGetXMLDesc interface or (2) image to the virDomainSaveImageGetXMLDesc interface.