CVE-2026-1966

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-1966

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-1966.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-1966

Published

2026-02-05T11:38:28Z

Modified

2026-08-12T15:31:31Z

Severity

2.4 (Low) CVSS_V4 - CVSS:4.0/AV:P/AC:H/AT:P/PR:H/UI:A/VC:L/VI:L/VA:L/SC:H/SI:H/SA:H CVSS Calculator

Summary

YugabyteDB Anywhere Exposes LDAP Credentials in Cleartext in Web UI

Details

YugabyteDB Anywhere displays LDAP bind passwords configured via gflags in cleartext within the web UI. An authenticated user with access to the configuration view could obtain LDAP credentials, potentially enabling unauthorized access to external directory services.

Database specific

{
    "cna_assigner": "Yugabyte",
    "cwe_ids": [
        "CWE-522"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/1xxx/CVE-2026-1966.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "2025.1.0.0"
                },
                {
                    "fixed": "2025.1.1.0"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}

References

Affected packages

Git / github.com/yugabyte/yugabyte-db

Affected ranges

Type

GIT

Repo

https://github.com/yugabyte/yugabyte-db

Events

Introduced

0585c935ab8ad2e61086448a45bc918c9019e6fd

Fixed

4c17ce32154ed05079f5313a4cf3b744ad5e74a8

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "2024.2.0.0"
        },
        {
            "fixed": "2024.2.6.0"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-1966.json"

vanir_signatures

[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "337600428723717074017499924163479501254",
            "length": 2814
        },
        "id": "CVE-2026-1966-20f3785f",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/yugabyte/yugabyte-db/commit/4c17ce32154ed05079f5313a4cf3b744ad5e74a8",
        "target": {
            "file": "java/yb-ysql-conn-mgr/src/test/java/org/yb/ysqlconnmgr/TestEnquote.java",
            "function": "testEnquote"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "179948618675293180613155698502977269206",
            "length": 1536
        },
        "id": "CVE-2026-1966-2d05f03c",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/yugabyte/yugabyte-db/commit/4c17ce32154ed05079f5313a4cf3b744ad5e74a8",
        "target": {
            "file": "src/odyssey/third_party/kiwi/kiwi/var.h",
            "function": "kiwi_vars_cas"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "175642241698264312483515968935189966768",
                "40245755743177755776604146422830598628",
                "222475090106648046575151977977693461404",
                "242725893241259730872347629806028952433",
                "113275242385585751738178565752064003718",
                "194947689243604707350610308841478907690",
                "136973795417218936124658893649415483400"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-1966-9d5c1f0c",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/yugabyte/yugabyte-db/commit/4c17ce32154ed05079f5313a4cf3b744ad5e74a8",
        "target": {
            "file": "java/yb-ysql-conn-mgr/src/test/java/org/yb/ysqlconnmgr/TestEnquote.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "97638338110788014445327403786247247325",
            "length": 63
        },
        "id": "CVE-2026-1966-bd7dd231",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/yugabyte/yugabyte-db/commit/4c17ce32154ed05079f5313a4cf3b744ad5e74a8",
        "target": {
            "file": "java/yb-ysql-conn-mgr/src/test/java/org/yb/ysqlconnmgr/TestEnquote.java",
            "function": "customizeMiniClusterBuilder"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "43030799941240351905895620426019372117",
                "213777844762311795428380113013082482332",
                "17075582522400435696373306995182048810",
                "71405927037659252063753489484099108267",
                "300241362081841736396048367105140460736",
                "229916019444506453456622988793646615669",
                "17183398649115371226873681268745094789"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-1966-eae081ae",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/yugabyte/yugabyte-db/commit/4c17ce32154ed05079f5313a4cf3b744ad5e74a8",
        "target": {
            "file": "src/odyssey/third_party/kiwi/kiwi/var.h"
        }
    }
]

vanir_signatures_modified

"2026-08-12T15:31:31Z"