Password Redaction Vulnerability in Insights-Core by Red Hat
CVE-2026-19391

6.5MEDIUM

Key Information:

Vendor

Red Hat
Status
Pen Drive Powered By Red Hat Lightspeed
Red Hat Certification Program For Red Hat Enterprise Linux 9
Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 9
Vendor
CVE Published:
11 August 2026

What is CVE-2026-19391?

A security flaw exists in the insights-core component of Red Hat, where the password redaction mechanism fails to properly redact sensitive information. This flaw allows credentials such as SSSD LDAP bind passwords and Pacemaker fence device credentials to be exposed in cleartext within archives submitted to console.redhat.com. As a result, this vulnerability presents a risk of unauthorized access to sensitive systems, as these credentials may be included in logs or reports without adequate protection.

References

https://access.redhat.com/security/cve/CVE-2026-19391
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2513020
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank Arpit Jain (GitHub handle: arpitjain099) for reporting this issue.
.