If a request comes over LDAPI and the mechanism used is external, passwords can be retrieved if the requests come from the root user.