Low severity · published Feb 5, 2026
CVE-2026-1966
YugabyteDB Anywhere Exposes LDAP Credentials in Cleartext in Web UI
2.4
CVSS
0.2%
EPSS
No
On KEV
Description
YugabyteDB Anywhere displays LDAP bind passwords configured via gflags in cleartext within the web UI. An authenticated user with access to the configuration view could obtain LDAP credentials, potentially enabling unauthorized access to external directory services.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 8% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
YA
YugabyteDB Anywhere · YugabyteDB Inc
2025.1.0.0 before 2025.1.1.0; 2024.2.0.0 before 2024.2.6.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-1966
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-1966
docs.yugabyte.com
https://docs.yugabyte.com/stable/secure/vulnerability-disclosure-policy/
More from YugabyteDB Anywhere
6.8
CVE-2025-8864
Shared Access Signature token is not masked in the backup configuration response and is also exposed in the yb_backup logs
5.1
CVE-2025-8866
YugabyteDB Anywhere web server does not properly enforce authentication for the /metamaster/universe API endpoint