A flaw was found in 389-ds-base. (CVE-2026-19843)

CVE-2026-19843 is a command injection vulnerability in 389-ds-base's Cockpit 389 Console LDAP editor. The flaw occurs because the LDAP editor constructs an ldapsearch shell command by embedding an LDAP entry's distinguished name (DN) without proper escaping. An LDAP user with delegated privileges to create or rename directory entries can insert shell metacharacters in the DN. When a Cockpit administrator views the entry, the shell command executes with root privileges on the directory server host, leading to potential full system compromise. Red Hat has issued security advisories RHSA-2026:64768 and RHSA-2026:64769 providing patches for Red Hat Directory Server 13 and its Extended Update Support version on RHEL 10.

Successful exploitation allows an LDAP user with delegated privileges to execute arbitrary shell commands as root on the directory server host. This results in complete compromise of the affected system, including confidentiality, integrity, and availability impacts. The CVSS v3.1 base score is 8.4 (High), reflecting network attack vector, low attack complexity, high privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.

Red Hat has released official security updates that fix this vulnerability. Users should apply the updates provided in Red Hat Advisory RHSA-2026:64768 for Red Hat Directory Server 13 and RHSA-2026:64769 for the Extended Update Support version on RHEL 10. Detailed update instructions are available at https://access.redhat.com/articles/11258. Applying these patches mitigates the vulnerability. No additional mitigation steps are specified or required beyond applying the official updates.