Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Red Hat Directory Server can grant admin rights via faulty login

CVE-2026-18922 · published 1 month ago
Summary

The Red Hat Directory Server versions listed can be tricked into giving full admin privileges when an attacker first tries a plain login with wrong credentials and then makes an anonymous connection. This happens because leftover identity information is mistakenly reused. Update the server with the latest security patches and disable plain text authentication if it is not needed.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
Ecosystem VendorProductAffected versions
– red hat red hat directory server 11.9 for rhel 8 All versions
– red hat red hat directory server 12.4 e4s for rhel 9 All versions
– red hat red hat enterprise linux 6 extended lifecycle support - extension All versions
– red hat red hat enterprise linux 8.6 advanced mission critical update support All versions
– red hat red hat enterprise linux 8.6 extended update support long-life add-on All versions
Ubuntu:Pro:16.04:LTS canonical 389-ds-base All versions
– red hat red hat directory server 11.7 e4s for rhel 8 All versions
– red hat red hat directory server 12.2 e4s for rhel 9 All versions
– red hat red hat enterprise linux 10.0 extended update support All versions
– red hat red hat enterprise linux 7 extended lifecycle support All versions
– red hat red hat enterprise linux 8 All versions
– red hat red hat enterprise linux 8.4 advanced mission critical update support All versions
– red hat red hat enterprise linux 8.4 extended update support long-life add-on All versions
– red hat red hat enterprise linux 8.8 telecommunications update service All versions
– red hat red hat enterprise linux 8.8 update services for sap solutions All versions
– red hat red hat enterprise linux 9 All versions
– red hat red hat enterprise linux 9.2 update services for sap solutions All versions
– red hat red hat enterprise linux 9.4 update services for sap solutions All versions
– red hat red hat enterprise linux 9.6 extended update support All versions
– red hat red hat directory server 11 All versions
– red hat red hat directory server 12 All versions
– red hat red hat directory server 13 All versions
– red hat red hat enterprise linux 10 All versions
– red hat red hat enterprise linux 6 All versions
– red hat red hat directory server 11.5 e4s for rhel 8 All versions
Original advisory text
389-ds-base: 389-ds-base: sasl plain authentication allows privilege escalation to directory manager via stale identity in cyrus sasl auxiliary property
A flaw was found in 389 Directory Server. During SASL PLAIN authentication, a stale identity carried in a Cyrus SASL auxiliary property from a prior failed bind attempt can be installed on a connection following a subsequent, unrelated successful bind, regardless of which SASL mechanism completes that second bind. An attacker can send a SASL PLAIN bind as cn=Directory Manager with an incorrect password, then complete a SASL ANONYMOUS bind on the same connection, causing the server to grant Directory Manager authority without any valid credentials. A variant using a valid low-privileged account's own successful bind instead of an anonymous one is also possible.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-287Improper Authentication
Timeline
Published7 Sep 2026
Updated11 Oct 2026
First seen8 Sep 2026
Sources
CVE-2026-18922 · NVD
CVE-2026-18922 · MITRE
UBUNTU-CVE-2026-18922 · OSV
Track software like this
Free during beta