Copyright © 2012 Red Hat, Inc. All rights reserved. Critical 2026-09-07T12:33:00 389-ds-base: 389-ds-base: SASL PLAIN authentication allows privilege escalation to Directory Manager via stale identity in Cyrus SASL auxiliary property 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CWE-287

A flaw was found in 389 Directory Server. During SASL PLAIN authentication, a stale identity carried in a Cyrus SASL auxiliary property from a prior failed bind attempt can be installed on a connection following a subsequent, unrelated successful bind, regardless of which SASL mechanism completes that second bind. An attacker can send a SASL PLAIN bind as cn=Directory Manager with an incorrect password, then complete a SASL ANONYMOUS bind on the same connection, causing the server to grant Directory Manager authority without any valid credentials. A variant using a valid low-privileged account's own successful bind instead of an anonymous one is also possible.

This flaw is rated Critical because it allows a remote, unauthenticated attacker to gain full Directory Manager privileges over an LDAPS connection — with no valid account, no user interaction, and no non-default configuration required. Flaw is exploitable by a remote unauthenticated attacker that fully compromises confidentiality, integrity, and availability without requiring user interaction. Red Hat would like to thank Chris Jarrett-Davies (OpenAI Security Research) for reporting this issue. Administrators can restrict nsslapd-allowed-sasl-mechanisms to only the mechanisms actually required (e.g. GSSAPI, EXTERNAL, GSS-SPNEGO), excluding PLAIN. Since the exploit chain requires the first bind attempt to be a failed SASL PLAIN bind as cn=Directory Manager, removing PLAIN from the allowed mechanism list prevents that step entirely — this blocks both the originally reported variant (valid low-privileged account) and the zero-credential SASL ANONYMOUS variant, since both depend on the same initial PLAIN bind to plant the stale identity. Red Hat Directory Server 11.7 E4S for RHEL 8 2026-09-08T00:00:00Z RHSA-2026:64792 redhat-ds:11-8080020260903102346.f969626e Red Hat Directory Server 11.9 for RHEL 8 2026-09-08T00:00:00Z RHSA-2026:64793 redhat-ds:11-8100020260904171440.37ed7c03 Red Hat Directory Server 12.2 E4S for RHEL 9 2026-09-08T00:00:00Z RHSA-2026:64779 redhat-ds:12-9020020260903155914.1674d574 Red Hat Directory Server 12.4 E4S for RHEL 9 2026-09-08T00:00:00Z RHSA-2026:64780 redhat-ds:12-9040020260903102623.1674d574 Red Hat Enterprise Linux 10 2026-09-08T00:00:00Z RHSA-2026:64785 389-ds-base-0:3.2.0-10.el10_2 Red Hat Enterprise Linux 10.0 Extended Update Support 2026-09-08T00:00:00Z RHSA-2026:64804 389-ds-base-0:3.0.6-21.el10_0 Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION 2026-09-08T00:00:00Z RHSA-2026:64811 389-ds-base-0:1.2.11.15-97.el6_10.1 Red Hat Enterprise Linux 7 Extended Lifecycle Support 2026-09-08T00:00:00Z RHSA-2026:64771 389-ds-base-0:1.3.11.1-15.el7_9 Red Hat Enterprise Linux 8 2026-09-08T00:00:00Z RHSA-2026:64791 389-ds:1.4-8100020260904155442.25e700aa Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support 2026-09-08T00:00:00Z RHSA-2026:64789 389-ds:1.4-8040020260901171549.96015a92 Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On 2026-09-08T00:00:00Z RHSA-2026:64789 389-ds:1.4-8040020260901171549.96015a92 Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support 2026-09-08T00:00:00Z RHSA-2026:64790 389-ds:1.4-8060020260901145727.824efc52 Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On 2026-09-08T00:00:00Z RHSA-2026:64790 389-ds:1.4-8060020260901145727.824efc52 Red Hat Enterprise Linux 8.8 Telecommunications Update Service 2026-09-08T00:00:00Z RHSA-2026:64776 389-ds:1.4-8080020260831180218.6dbb3803 Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions 2026-09-08T00:00:00Z RHSA-2026:64776 389-ds:1.4-8080020260831180218.6dbb3803 Red Hat Enterprise Linux 9 2026-09-08T00:00:00Z RHSA-2026:64784 389-ds-base-0:2.8.0-10.el9_8 Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions 2026-09-08T00:00:00Z RHSA-2026:64778 389-ds-base-0:2.2.4-22.el9_2 Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions 2026-09-08T00:00:00Z RHSA-2026:64781 389-ds-base-0:2.4.5-29.el9_4 Red Hat Enterprise Linux 9.6 Extended Update Support 2026-09-08T00:00:00Z RHSA-2026:64783 389-ds-base-0:2.6.1-24.el9_6 Red Hat Directory Server 12 Affected 389-ds-base Red Hat Directory Server 13 Not affected 389-ds-base https://www.cve.org/CVERecord?id=CVE-2026-18922 https://nvd.nist.gov/vuln/detail/CVE-2026-18922