TL;DR: CVE-2026-19391 is a credential disclosure bug in Red Hat's insights-core, the framework that collects diagnostic archives from RHEL systems and uploads them to console.redhat.com. The password redaction layer only recognizes values stored under the literal key password. SSSD LDAP bind credentials (ldap_default_authtok) and Pacemaker fence device credentials use different key names, so they pass through unredacted into archives sent to Red Hat's cloud. Any RHEL system running insights-client with SSSD LDAP authentication or Pacemaker clusters is affected.

What happened

Red Hat Insights is a proactive monitoring service included with every active RHEL subscription. The insights-client daemon collects system configuration data, packages it into an archive, and uploads it to console.redhat.com for analysis. insights-core is the Python framework that powers this collection and parsing pipeline.

The redaction layer in insights-core scans collected data for sensitive values and strips them before the archive leaves the machine. The problem: the redaction logic looks for credentials stored under the literal key name password. If a configuration file uses a different key name for a credential, the value is treated as non-sensitive and left untouched.

Two critical cases fall through this gap:

• SSSD LDAP bind passwords: SSSD (System Security Services Daemon) stores its LDAP bind credential under the key ldap_default_authtok in /etc/sssd/sssd.conf. SSSD is the standard mechanism for integrating RHEL with LDAP directories and Active Directory. The bind password authenticates the system to the directory server. Because ldap_default_authtok does not match the string password, the redaction layer leaves it in cleartext inside the uploaded archive.
• Pacemaker fence device credentials: Pacemaker is the cluster resource manager shipped with RHEL High Availability. Fence devices (iSCSI, IPMI, VMware, etc.) protect cluster quorum by forcibly resetting unresponsive nodes. Each fence device stores its authentication credential under device-specific key names that also do not match password. These credentials appear in cleartext in the archive as well.

The archives containing these cleartext passwords are transmitted to and stored on Red Hat's cloud infrastructure. The exposure surface depends on who can access those archives on the Red Hat side, how long they are retained, and whether downstream analysis pipelines log or display the raw file contents.

Who is affected

Any RHEL system running insights-client with either of these configurations:

• SSSD configured for LDAP or Active Directory authentication (extremely common in enterprise environments). The ldap_default_authtok parameter is present in sssd.conf whenever SSSD authenticates to an LDAP backend.
• Pacemaker HA clusters with fence devices that require authentication credentials.

Red Hat Insights ships with all active RHEL subscriptions. Red Hat reports that 90% of Fortune 500 companies run RHEL. The insights-client package is enabled by default on many RHEL 8 and 9 deployments, meaning enterprise environments that have adopted Insights for vulnerability scanning and compliance reporting are transmitting these credentials to Red Hat with every archive upload.

What to do

No fixed version has been released at the time of writing. Until a patch is available, the safest mitigations are:

• Disable insights-client uploads on systems where SSSD LDAP or Pacemaker fence credentials are present. Edit /etc/insights-client/insights-client.conf and set auto_update=False, or stop the timer: systemctl disable --now insights-client.timer.
• Review uploaded archives from affected systems. Run insights-client --output /tmp/archive.tar.gz locally, then search for credential patterns: grep -r 'ldap_default_authtok' /tmp/extracted/ and check Pacemaker fence configuration sections.
• Rotate exposed credentials if archives have been uploaded from affected systems. Change the SSSD LDAP bind password in your directory and update sssd.conf. Regenerate Pacemaker fence device credentials.
• Use keytab-based SSSD bind: For SSSD specifically, consider using a keytab-based bind instead of a password. SSSD supports ldap_default_authtok_type = keytab, which avoids storing a plaintext password in the configuration file entirely.

Why it matters

SSSD bind passwords authenticate the RHEL system to its identity backend. An attacker who obtains these credentials can query the LDAP directory as the service account, enumerate users and groups, and potentially authenticate to other systems using the same bind DN. In Active Directory-integrated environments, the bind account may have broad read access across the domain.

Pacemaker fence credentials are arguably more dangerous. Fence devices can force-reset cluster nodes. If an attacker gains fence device credentials, they can trigger node resets through the fence agent, disrupting HA services or causing a split-brain scenario.

The vulnerability is not in SSSD or Pacemaker themselves. The affected component is the data collection pipeline. The credentials are correctly stored in their respective configuration files on the RHEL system. The fault is in insights-core's redaction engine, which has an incomplete view of what constitutes a credential. A fix should expand the redaction key list to cover ldap_default_authtok, fence device attributes, and any other non-obvious credential fields.

References

• CVE-2026-19391 on hol.org
• Red Hat insights-core on GitHub
• Red Hat Insights product page
• SSSD configuration reference