The vulnerability causes LDAP bind passwords configured via gflags to appear in cleartext within the YugabyteDB Anywhere web UI. An authenticated user who has access to the configuration view can read these credentials, potentially enabling unauthorized access to external directory services. The flaw represents a confidentiality breach of sensitive authentication data. The likely attack vector is an authenticated user with configuration privileges, as only users who can view the settings will see the passwords.

YugabyteDB Inc’s YugabyteDB Anywhere product is affected by this issue. No specific version range is listed, so the problem exists in the current releases where LDAP bind passwords are displayed through the web interface.

The CVSS base score of 2.4 indicates low severity, and the EPSS probability is under 1 percent, with the vulnerability not listed in the KEV catalog. The risk profile is limited to individuals who possess privileged configuration access, and exploitation requires that the attacker first authenticates to the system. While exposure of LDAP credentials can lead to further compromises of external directory services, the overall likelihood and impact remain low due to the narrow attack surface and the necessity of pre‑existing user credentials.