Registry credentials are captured in plain text in dynflow task during repository discovery.
This issue has been addressed in the following products:
Red Hat Satellite 6.6 for RHEL 7
Via RHSA-2019:3172 https://access.redhat.com/errata/RHSA-2019:3172
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):