Description

A flaw was found in insights-core where the password redaction layer fails to recognize credentials not keyed under the literal string 'password'. This allows SSSD LDAP bind passwords (ldap_default_authtok) and Pacemaker fence device credentials to be included in cleartext in archives uploaded to console.redhat.com.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-11T07:17:29.347Z",
  "pubdate": "2026-08-11T07:17:29.347Z",
  "executiveSummary": "A credential exposure vulnerability exists within the password redaction layer of insights-core, impacting systems utilizing specific authentication and clustering configurations.\nThe vulnerability arises from insufficient key pattern matching, specifically failing to sanitize sensitive credentials unless explicitly keyed under the literal string 'password'.\nConsequently, sensitive cleartext authentication material, including SSSD LDAP bind passwords via ldap_default_authtok and Pacemaker fence device credentials, is improperly captured and embedded into diagnostic archives.\nThese generated archives are subsequently uploaded to console.redhat.com, potentially exposing sensitive authentication secrets to unauthorized entities with access to the uploaded diagnostic telemetry.\nThe risk implication involves unauthorized disclosure of high-privilege credentials, potentially facilitating lateral movement, privilege escalation, or unauthorized access to integrated directory services and cluster resources.\nExploitation requires the generation and transmission of diagnostic data containing the improperly redacted configuration parameters, typically occurring during standard telemetry collection or manual support data gathering operations.",
  "technicalDetails": "The root cause of the vulnerability resides in the sanitization logic of the insights-core password redaction layer, which implements rigid string matching restricted exclusively to the literal identifier 'password'.\nIt fails to dynamically evaluate hierarchical data structures, alternative nomenclature, or context-specific credential keys such as ldap_default_authtok utilized by SSSD for LDAP bind operations, as well as sensitive authentication strings associated with Pacemaker fence devices.\nThe vulnerable component is the telemetry data collection and redaction engine within insights-core that processes system configuration files prior to generating archive bundles intended for upload to console.redhat.com.\nDuring the attack flow, the insights-core utility executes data collection routines that ingest configuration states containing unmasked secrets.\nBecause the redaction mechanism lacks recursive or comprehensive key-pattern recognition for alternate sensitive keys, the plaintext credentials bypass the filtering layer entirely.\nThe unredacted authentication secrets are subsequently written into the resulting diagnostic archive files in cleartext format.\nUpon completion of the archive generation, the telemetry payload is transmitted over the network and uploaded to console.redhat.com, exposing the cleartext credentials within the centralized telemetry repository.\nPost-exploitation impact encompasses the extraction of harvested SSSD LDAP bind tokens and Pacemaker fencing credentials by malicious actors or unauthorized observers possessing read access to console.redhat.com telemetry data.\nCompromised credentials can be leveraged to impersonate system services, query LDAP directories, or manipulate high-availability cluster fencing mechanisms depending on the scope of the exposed privileges."
}