The vulnerability in insights-core arises because its password redaction mechanism does not recognize credentials unless they are keyed under the literal string 'password'. Consequently, sensitive credentials such as SSSD LDAP bind passwords (ldap_default_authtok) and Pacemaker fence device credentials are included in cleartext in uploaded archives. The default configuration of insights-client is affected, potentially exposing these credentials to anyone with access to the archives uploaded to console.redhat.com. The CVSS 3.1 score is 6.5 (medium severity) with network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality impact. No official patch or fix is currently available. Red Hat recommends mitigating by excluding specific configuration files or adding keyword/pattern redaction rules until a patch is released.

Sensitive credentials such as LDAP bind passwords and Pacemaker fence device credentials may be exposed in cleartext within archives uploaded by insights-client. This could lead to unauthorized disclosure of sensitive authentication information to individuals who have access to these archives. The vulnerability does not impact integrity or availability but has a high confidentiality impact.

Currently, no official patch or fix is available for this vulnerability. Red Hat advises users to mitigate the issue by excluding the sssd_config, sssd_conf_d, and cib_xml files via the /etc/insights-client/file-redaction.yaml configuration file. Alternatively, users can add keyword or pattern redaction rules covering ldap_default_authtok and fence passwd/password XML forms to prevent sensitive credentials from being included in uploaded archives. These mitigations should be applied until an official patch for insights-core is released.