read-attribute operation is leaking value when user is not authorized to read that attribute

[standalone@localhost:9990 /] :whoami(verbose=true)
{
    "outcome" => "success",
    "result" => {"identity" => {
        "username" => "monitor",
        "realm" => "ManagementRealm"
    }}
}
[standalone@localhost:9990 /] /subsystem=datasources/data-source=ExampleDS:read-attribute(name=password)
{
    "outcome" => "failed",
    "result" => "sa",
    "failure-description" => "JBAS013456: Unauthorized to execute operation 'read-attribute' for resource '[
    (\"subsystem\" => \"datasources\"),
    (\"data-source\" => \"ExampleDS\")
]' -- \"Permission denied\"",
    "rolled-back" => true
}