The vulnerability CVE-2026-11770 affects 389 Directory Server, specifically in the CleanAllRUV replication status-check extended operation. The handler performs LDAP searches against cn=config with elevated privileges and returns a boolean match result. Due to improper neutralization of special elements in LDAP queries (LDAP injection), an unauthenticated remote attacker can inject LDAP search filters to extract sensitive configuration metadata, including replication bind distinguished names and password storage schemes. This flaw is particularly exploitable when the nsslapd-allow-anonymous-access setting is enabled by default. Red Hat has assigned a CVSS v3.1 score of 7.5 (high severity) reflecting network attack vector, no privileges required, no user interaction, and high confidentiality impact. The vendor has released patches and advisories addressing this issue.

An unauthenticated remote attacker can exploit this LDAP injection vulnerability to extract sensitive server configuration metadata from the 389 Directory Server. This includes replication bind distinguished names and password storage scheme information, potentially exposing confidential data. The vulnerability does not impact integrity or availability but poses a high confidentiality risk.

Red Hat has released security updates that fix this vulnerability; applying these updates is the recommended remediation. Additionally, Red Hat advises setting the nsslapd-allow-anonymous-access parameter to rootdse or off to reduce exposure. Restricting LDAP ports to trusted networks and using strong replication manager passwords further mitigates risk. Monitoring for the extended operation OID 2.16.840.1.113730.3.6.8 can help detect exploitation attempts.