PT-2026-6551 · Yugabyte · Yugabytedb Anywhere

CVE-2026-1966 · Published 2026-02-05 · Updated 2026-02-05

Positive Technologies (AI Summary)

CVSS v4.0

2.4

Low

Base vector

AV:P/AC:H/AT:P/PR:H/UI:A/VC:L/VI:L/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions YugabyteDB Anywhere (affected versions not specified)

Description YugabyteDB Anywhere reveals LDAP bind passwords in plain text within its web user interface. An authenticated user who can access the configuration view may be able to obtain these credentials, which could lead to unauthorized access to external directory services.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2026-1966

Affected Products

Yugabytedb Anywhere

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/1xxx/CVE-2026-1966.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-1966 · Security Note
• https://osv.dev/vulnerability/CVE-2026-1966 · Vendor Advisory
• https://t.me/cveNotify/150970 · Telegram Post
• https://twitter.com/CVEnew/status/2019392392919396681 · Twitter Post
• https://t.me/CVEtracker/43814 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2019395652472488024 · Twitter Post
• https://github.com/yugabyte/yugabyte-db · Note
• https://docs.yugabyte.com/stable/secure/vulnerability-disclosure-policy · Note