An issue in Trisolutions BRPerfX version 1.4.4.0 exposes LDAP credentials in plaintext within the administrative configuration interface. (CVE-2026-36436)

CVE-2026-36436 describes a vulnerability in Trisolutions BRPerfX version 1.4.4.0 where LDAP credentials are exposed in plaintext within the administrative configuration interface. This exposure occurs because the credentials are accessible in the client-side code, allowing any authenticated administrator to retrieve them. The vulnerability is classified under CWE-522 (Insufficiently Protected Credentials). The CVSS v3.1 base score is 7.5, indicating a high severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The impact is confidentiality loss of LDAP credentials, but no integrity or availability impact is noted.

The vulnerability allows an authenticated administrator to obtain LDAP credentials in plaintext by inspecting client-side code. This compromises the confidentiality of LDAP credentials, potentially enabling unauthorized access to LDAP services if the credentials are misused. There is no direct impact on system integrity or availability reported.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrative interface access to trusted personnel only and consider monitoring for unauthorized access. Avoid sharing administrative credentials broadly.