Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.5
CVE-2026-19404: 389 Directory Server: Unauthenticated Clients Can Access Replication Functions
CVE-2026-19404 · published 2 months ago
Summary
An unauthenticated user can access and manipulate replication settings, potentially disrupting directory server operations. This is because the default settings allow anonymous access. To fix this, ensure that only authorized users can access the directory server.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | red hat | red hat directory server 11 | All versions |
| – | red hat | red hat directory server 12 | All versions |
| – | red hat | red hat directory server 13 | All versions |
| – | red hat | red hat enterprise linux 10 | All versions |
| – | red hat | red hat enterprise linux 6 | All versions |
| – | red hat | red hat enterprise linux 7 | All versions |
| – | red hat | red hat enterprise linux 8 | All versions |
| – | red hat | red hat enterprise linux 9 | All versions |
| Debian:11 | debian | 389-ds-base | All versions |
| Debian:12 | debian | 389-ds-base | All versions |
| Debian:13 | debian | 389-ds-base | All versions |
| Ubuntu:Pro:16.04:LTS | canonical | 389-ds-base | All versions |
Original advisory text
389-ds-base: 389-ds-base: missing authorization allows anonymous clients to start or abort cleanallruv replication maintenance
A flaw was found in 389 Directory Server. The CleanAllRUV and Abort CleanAllRUV replication-maintenance extended operations perform no authorization check, allowing an unauthenticated remote attacker to invoke them when nsslapd-allow-anonymous-access is enabled (the default), or any authenticated low-privilege user to invoke them otherwise. This allows removal of a replica ID from replication metadata, purging of changelog records, and interruption of administrator-initiated cleanup, which can leave replication inconsistent or unavailable.
References
- https://security-tracker.debian.org/tracker/CVE-2026-19404 Vendor Advisory
- https://ubuntu.com/security/CVE-2026-19404 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-19404 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-19404 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2513036 Third Party Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Type
CWE-862Missing Authorization
Timeline
Published10 Aug 2026
Updated4 Nov 2026
First seen10 Aug 2026
Sources
CVE-2026-19404 · NVD
CVE-2026-19404 · MITRE
DEBIAN-CVE-2026-19404 · OSV
UBUNTU-CVE-2026-19404 · OSV
Track software like this
Free during beta