CVE-2026-19391: insights-core Information Disclosure Flaw

CVE-2026-19391 Overview

CVE-2026-19391 is an information disclosure vulnerability in Red Hat insights-core. The password redaction layer only matches credentials keyed under the literal string password. As a result, secrets stored under other key names bypass redaction and are transmitted in cleartext. Affected data includes SSSD LDAP bind passwords (ldap_default_authtok) and Pacemaker fence device credentials. These secrets are embedded in diagnostic archives uploaded to console.redhat.com. The flaw is classified under CWE-312: Cleartext Storage of Sensitive Information.

Critical Impact
Directory service and cluster fencing credentials leave the customer environment in cleartext within Insights archives, enabling downstream credential compromise if archive storage or transit is exposed.

Affected Products

Red Hat insights-core (client library used by Red Hat Insights)
Systems configured with SSSD using ldap_default_authtok for LDAP bind
Systems running Pacemaker with fence device credentials

Discovery Timeline

2026-08-11 - CVE-2026-19391 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-19391

Vulnerability Analysis

Red Hat Insights collects configuration and diagnostic data from registered hosts and uploads archives to console.redhat.com for analysis. Before upload, insights-core applies a redaction layer intended to strip sensitive values such as passwords. The redaction implementation identifies candidate secrets by matching the literal token password in configuration keys. Credentials stored under alternative key names are not recognized and pass through in cleartext.

Two concrete exposures are documented. SSSD stores LDAP bind secrets under the ldap_default_authtok directive in /etc/sssd/sssd.conf. Pacemaker fence agents store device credentials under agent-specific parameter names such as passwd, login_passwd, or ipmi_password. Neither key contains the substring the redactor requires, so both values are collected verbatim.

Root Cause

The root cause is an incomplete denylist in the credential-redaction routine. The filter relies on a narrow keyword match rather than a semantic understanding of which fields hold secrets. This is a classic [CWE-312] pattern where sensitive data is transmitted without adequate scrubbing.

Attack Vector

The attack vector is network-adjacent to the Insights data pipeline. An attacker with authenticated low-privilege access to the Red Hat Insights tenant, or to any location where uploaded archives are stored, cached, or forwarded, can read the cleartext credentials. Recovered SSSD bind passwords grant read access to enterprise LDAP directories. Recovered fence credentials enable node fencing, cluster disruption, or lateral movement to management interfaces such as IPMI, iDRAC, or iLO.

No verified public exploit is required. The exposure occurs automatically whenever an affected host generates and uploads an Insights archive.

Detection Methods for CVE-2026-19391

Indicators of Compromise

Presence of ldap_default_authtok values in cleartext within locally generated Insights archives under /var/tmp/insights-* or insights-archive-*.tar.gz.
Fence device credential parameters (passwd, login_passwd, agent-specific *_password keys) appearing unredacted in collected pcs or cib.xml output within the archive.
Insights uploads originating from hosts with SSSD LDAP authentication or Pacemaker fencing configured, prior to patch application.

Detection Strategies

Inspect the most recent Insights archive on each host with tar -tzf and grep the extracted contents for authtok, passwd=, and known credential strings before upload.
Audit sssd.conf and Pacemaker cib.xml on managed hosts to enumerate which systems carry credentials at risk of exfiltration via insights-client.
Correlate insights-client execution events with outbound TLS connections to cert-api.access.redhat.com and console.redhat.com in endpoint telemetry.

Monitoring Recommendations

Alert on insights-client runs from hosts identified as directory servers or cluster nodes until patched packages are deployed.
Monitor changes to /etc/sssd/sssd.conf and Pacemaker resource definitions and treat credential rotation events as high-priority.
Track the insights-core package version across the fleet and flag hosts running versions that predate the Red Hat fix.

How to Mitigate CVE-2026-19391

Immediate Actions Required

Update insights-core to the fixed version supplied by Red Hat as soon as the errata is available. Consult the Red Hat CVE page for CVE-2026-19391 for package versions.
Rotate all ldap_default_authtok bind passwords used by SSSD on hosts that have previously uploaded Insights archives.
Rotate Pacemaker fence device credentials, including IPMI, iLO, iDRAC, and vCenter accounts referenced by fence agents.
Request deletion of historical Insights archives that predate remediation, following the process documented in the Red Hat Bug Report.

Patch Information

Red Hat tracks remediation under Bugzilla 2513020 and the Red Hat CVE Details advisory. Apply vendor errata for insights-core when published and re-run insights-client --status to confirm the updated collector is in use.

Workarounds

Disable automatic Insights uploads on hosts holding SSSD LDAP bind or Pacemaker fence credentials until the fix is installed, using insights-client --disable-schedule.
Extend local redaction by populating /etc/insights-client/file-redaction.yaml and file-content-redaction.yaml with patterns matching ldap_default_authtok, passwd, and fence-agent password parameters.
Where feasible, migrate SSSD from ldap_default_authtok cleartext to Kerberos or GSSAPI authentication to eliminate the stored password.

bash

# /etc/insights-client/file-content-redaction.yaml
# Redact credentials the default filter misses (CVE-2026-19391)
patterns:
  regex:
    - "ldap_default_authtok\\s*=\\s*.*"
    - "(?i)(passwd|password|authtok)\\s*=\\s*.*"
    - "(?i)<nvpair[^>]*name=\"(passwd|login_passwd|ipmi_password)\"[^>]*value=\"[^\"]*\""
keywords:
  - ldap_default_authtok
  - login_passwd
  - ipmi_password