Stephen Benjamin of Red Hat reports: CloudForms stores user account password in a recoverable format. This has been corrected by moving to bcrypt.
Statement: This issue is resolved in CloudForms 3.0.