Bug 2513020 (CVE-2026-19391)

Summary: CVE-2026-19391 insights-core: insights-core: Incomplete credential redaction exposes SSSD bind passwords and Pacemaker fence credentials in uploaded archives
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: anthomas, aprice, derez, ehelms, ggainey, jdobes, jpasqual, jsamir, juwatts, kaycoth, kgaikwad, mdellweg, mhulan, nmoumoul, oezr, orabin, osousa, pcreech, rchan, rhel-process-autobot, smallamp, tmalecek, watson-tool-maintainers, xiaoxwan, zzhou
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in insights-core where the password redaction layer fails to recognize credentials not keyed under the literal string 'password'. This allows SSSD LDAP bind passwords (ldap_default_authtok) and Pacemaker fence device credentials to be included in cleartext in archives uploaded to console.redhat.com.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-10 03:44:48 UTC 
A flaw was found in insights-core. The password redaction layer in insights/cleaner/password.py only recognizes credentials keyed under the literal string 'password'. SSSD's ldap_default_authtok and Pacemaker CIB fence device credentials stored as XML attributes (name="passwd" value="...") bypass the redaction entirely. Because the sssd_config, sssd_conf_d, and cib_xml specs are not declared filterable, the full file contents pass through the cleaner unmodified, and these credentials are included in cleartext in archives uploaded to console.redhat.com. This allows anyone with access to the uploaded archives to read LDAP bind passwords and cluster fence device credentials (IPMI, iLO, DRAC, vCenter). The default insights-client configuration is affected with no non-default settings required.