CVE-2026-1966
Low
Description
YugabyteDB Anywhere displays LDAP bind passwords configured via gflags in cleartext within the web UI. An authenticated user with access to the configuration view could obtain LDAP credentials, potentially enabling unauthorized access to external directory services.
SeverityLow
CVSS2.4
Exploit probability—
ProductYugabyteDB Anywhere
PublishedFeb 5, 2026
First seenFeb 5, 2026
Weakness typeCWE-522CWE-522
How to fix
Update
- YugabyteDB Inc YugabyteDB Anywhere2025.1.1.0, 2024.2.6.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| YugabyteDB Inc YugabyteDB Anywhere | 2025.1.0.0 ≤ v < 2025.1.1.0, 2024.2.0.0 ≤ v < 2024.2.6.0 | 2025.1.1.0, 2024.2.6.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.