CVE-2026-19404 is a moderate severity vulnerability in 389 Directory Server where the CleanAllRUV and Abort CleanAllRUV replication-maintenance extended operations lack authorization checks. When the nsslapd-allow-anonymous-access setting is enabled (the default), unauthenticated remote attackers can invoke these operations. If anonymous access is disabled, any authenticated user, regardless of privilege level, can still invoke them due to missing authorization checks. Exploitation allows attackers to remove replica IDs from replication metadata, purge changelog records, and interrupt cleanup processes, potentially causing replication inconsistencies or service unavailability. The vulnerability is tracked under CWE-862 (Missing Authorization).

The vulnerability allows unauthorized modification of replication metadata and changelog records, which can disrupt replication consistency and availability. It does not impact confidentiality but can degrade integrity and availability of the directory replication service. Attackers can cause denial of service or inconsistent replication states by invoking replication-maintenance operations without proper authorization.

Set the nsslapd-allow-anonymous-access configuration to rootdse or off to block exploitation by unauthenticated clients as an interim mitigation. However, this does not prevent authenticated low-privilege users from exploiting the flaw. Restrict access to replication LDAP ports to trusted networks as a defense-in-depth measure pending an official code fix. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.