Red Hat Security Advisory: 389-ds-base security update

CVE-2026-18922 is a critical vulnerability in 389 Directory Server where during SASL PLAIN authentication, a stale identity carried in a Cyrus SASL auxiliary property from a prior failed bind can be installed on a connection after a subsequent unrelated successful bind, regardless of the SASL mechanism used in the second bind. This allows an attacker to escalate privileges to Directory Manager by first sending a failed SASL PLAIN bind as cn=Directory Manager with an incorrect password, then completing a SASL ANONYMOUS or a valid low-privileged bind on the same connection, causing the server to grant Directory Manager authority without valid credentials. The flaw impacts confidentiality, integrity, and availability. Red Hat has issued a patch for 389-ds-base on RHEL 7 Extended Lifecycle Support to fix this issue. The vulnerability has a CVSS v3.1 base score of 9.8 (critical).

This vulnerability allows a remote unauthenticated attacker to gain full Directory Manager privileges on 389 Directory Server over an LDAPS connection without valid credentials or user interaction. This results in complete compromise of confidentiality, integrity, and availability of the directory server. The attacker can escalate privileges to the highest level, potentially leading to unauthorized access and control over directory data and services.

Red Hat has released an official security update for 389-ds-base on Red Hat Enterprise Linux 7 Extended Lifecycle Support that fixes this vulnerability. Administrators should apply this update promptly. As an additional mitigation, administrators can restrict the nsslapd-allowed-sasl-mechanisms configuration to exclude the PLAIN mechanism, allowing only required mechanisms such as GSSAPI, EXTERNAL, or GSS-SPNEGO. This prevents the initial failed SASL PLAIN bind required for exploitation and blocks both the anonymous and low-privileged account variants of the exploit.