CVE-2026-19391

MediumCVSS 6.5/10Last modified Nov 5, 2026

Description

A flaw was found in insights-core where the password redaction layer fails to recognize credentials not keyed under the literal string 'password'. This allows SSSD LDAP bind passwords (ldap_default_authtok) and Pacemaker fence device credentials to be included in cleartext in archives uploaded to console.redhat.com.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-312

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Red Hat	Pen Drive Powered by Red Hat Lightspeed	—
Red Hat	Pen Drive Powered by Red Hat Lightspeed	—
Red Hat	Red Hat Certification Program for Red Hat Enterprise Linux 9	—
Red Hat	Red Hat Certification Program for Red Hat Enterprise Linux 9	—
Red Hat	Red Hat Enterprise Linux 10	—
Red Hat	Red Hat Enterprise Linux 10	—
Red Hat	Red Hat Enterprise Linux 10	—
Red Hat	Red Hat Enterprise Linux 9	—
Red Hat	Red Hat Satellite 6	—
Red Hat	Red Hat Satellite 6	—
Red Hat	Red Hat Satellite 6	—
Red Hat	Red Hat Satellite 6	—

References

Timeline

Published: Aug 11, 2026
Last modified: Nov 5, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-193956.6In Qt for MCUs, a Text element that displays styled text halts the device if an <img> tag in the text contains an attribute with an empty va CVE-2026-193967.7A predictable seed in the pseudo-random number generator (PRNG) in the IFTTT pairing token generation of the ASUS RT-BE57 router allows an u CVE-2026-193977.7Missing authentication for a critical function in ASUS Control Center Express Agent allows an unauthenticated nearby user to control the hos CVE-2026-193986.8An out-of-bounds write in the SmiFlash SMM module of ASUS FA507NU and FA507NV BIOS allows a local administrator to cause a system crash (BS CVE-2026-19407.5An incomplete fix for CVE-2024-47778 allows an out-of-bounds read in gst_wavparse_adtl_chunk() function. The patch added a size validation c CVE-2026-194017.5Any remote client can crash a (debugging/non-release build type) NSD serve child by sending it a special crafted message with a specially tu CVE-2026-194046.5A flaw was found in 389 Directory Server. The CleanAllRUV and Abort CleanAllRUV replication-maintenance extended operations perform no autho CVE-2026-194062.7The Easy Appointments WordPress plugin before 4.0.1 does not restrict one of its appointment-listing REST endpoints to the records belonging CVE-2026-194077.7Bucket Squatting in Google Cloud Gemini Enterprise Agent Platform SDK for Python versions prior to 1.166.1 allows an attacker to achieve Rem CVE-2026-19416.4The WP Event Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wp_events' shortcode in all vers CVE-2026-194109.4An Incorrect Authorization vulnerability in GitHub Trigger Comment Control in Google Cloud Build prior to 2026-06-24 on Google Cloud Platfor CVE-2026-194113.9A NULL pointer vulnerability has been found in the the shim application of dp.c library. A missing NULL pointer could allow attackers to per