CVE-2026-19843
Description
A flaw was found in 389-ds-base. The Cockpit 389 Console's LDAP editor constructs an ldapsearch command by embedding an LDAP entry's distinguished name (DN) into a shell command string without proper escaping. An LDAP user with delegated privileges to create or rename directory entries could craft a malicious DN containing shell metacharacters. When a Cockpit administrator subsequently views the entry in the 389 Console, the embedded shell command executes with root privileges on the directory server host.
Statement
Important: This flaw allows an LDAP user holding delegated create/rename privileges over some subtree to achieve arbitrary command execution with root privileges on the host. The Cockpit 389 Console's LDAP editor embeds a raw LDAP entry DN into a double-quoted shell command string executed via Cockpit's privileged (superuser) channel. LDAP DN syntax does not require escaping of shell metacharacters such as $, (, and ), so a DN crafted with command substitution executes on the host when a more-privileged Cockpit operator subsequently views that entry. This compromises confidentiality, integrity, and availability of the host. Exploitation requires both a delegated LDAP write privilege and a privileged operator viewing the crafted entry; neither precondition alone is sufficient. This issue only affects Red Hat Directory Server deployments that include the Cockpit 389 Console; plain Red Hat Enterprise Linux does not ship this subpackage and is not affected.
Mitigation
Restrict Cockpit 389 Console access to trusted administrators, and restrict delegated LDAP add/rename privileges to trusted accounts, until a fix is available. This issue only affects Red Hat Directory Server deployments that include the Cockpit console; plain RHEL 389-ds-base is not affected.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 8.4 | N/A | 8.4 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | High | N/A | High |
| User Interaction | Required | N/A | Required |
| Scope | Changed | N/A | Changed |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
Red Hat CVSS v3 Score Explanation
PR:H reflects that exploitation requires a delegated LDAP role (user_admin/group_admin scoped to a subtree, or full Directory Administrators) able to create or rename an entry -- verified against 389-ds-base's default sample-entries ACI templates, not an arbitrary authenticated LDAP account. UI:R reflects that a separate, more-privileged Cockpit operator must view the entry to trigger it. S:C reflects escalation from an LDAP-scoped delegation to unrestricted root on the host via Cockpit's superuser channel.
Understanding the Weakness (CWE)
Confidentiality,Integrity,Availability,Non-Repudiation
Technical Impact: Execute Unauthorized Code or Commands; DoS: Crash, Exit, or Restart; Read Files or Directories; Modify Files or Directories; Read Application Data; Modify Application Data; Hide Activities
Attackers could execute unauthorized operating system commands, which could then be used to disable the product, or read and modify data for which the attacker does not have permissions to access directly. Since the targeted application is directly executing the commands instead of the attacker, any malicious activities may appear to come from the application or the application's owner.
Acknowledgements
Red Hat would like to thank Andrew Rukin (Arenadata) for reporting this issue.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
