Vulnerability · Published Feb 5, 2026 · Assigned by Yugabyte
CVE-2026-1966YugabyteDB Anywhere Exposes LDAP Credentials in Cleartext in Web UI
Low 2.4
In plain English
A low-severity security flaw in YugabyteDB Anywhere from YugabyteDB Inc. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities).
Severity (CVSS 4.0)2.4Low
Exploit odds (30 days)0.2%top 92.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
YugabyteDB Anywhere displays LDAP bind passwords configured via gflags in cleartext within the web UI. An authenticated user with access to the configuration view could obtain LDAP credentials, potentially enabling unauthorized access to external directory services.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| YugabyteDB Inc | YugabyteDB Anywhere | 2025.1.0.0 – before 2025.1.1.02024.2.0.0 – before 2024.2.6.0 |
Weakness: CWE-522 · Vector: CVSS:4.0/AV:P/AC:H/AT:P/PR:H/UI:A/VC:L/VI:L/VA:L/SC:H/SI:H/SA:H