A flaw was found in insights-core. The password redaction layer in insights/cleaner/password.py only recognizes credentials keyed under the literal string 'password'. SSSD's ldap_default_authtok and Pacemaker CIB fence device credentials stored as XML attributes (name="passwd" value="...") bypass the redaction entirely. Because the sssd_config, sssd_conf_d, and cib_xml specs are not declared filterable, the full file contents pass through the cleaner unmodified, and these credentials are included in cleartext in archives uploaded to console.redhat.com. This allows anyone with access to the uploaded archives to read LDAP bind passwords and cluster fence device credentials (IPMI, iLO, DRAC, vCenter). The default insights-client configuration is affected with no non-default settings required.