CVE-2026-18922: Improper Authentication in Red Hat Red Hat Directory Server 11.5 E4S for RHEL 8

The vulnerability in 389 Directory Server involves improper handling of stale identity information in the Cyrus SASL auxiliary property during SASL PLAIN authentication. Specifically, a stale identity from a prior failed bind attempt can be incorrectly applied after a subsequent successful bind, regardless of the SASL mechanism used. This flaw allows an attacker to perform a SASL PLAIN bind as Directory Manager with an incorrect password, followed by a successful SASL ANONYMOUS or low-privileged bind on the same connection, resulting in privilege escalation to Directory Manager. Red Hat has issued a security advisory and released updates to fix this issue in the 389-ds-base package.

Successful exploitation grants an attacker Directory Manager privileges without valid credentials, leading to full control over the directory server. This can compromise confidentiality, integrity, and availability of directory data. The CVSS v3.1 base score is 9.8 (critical), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Red Hat has released an official security update for the 389-ds-base package that fixes this vulnerability. Users should apply the update as described in Red Hat Advisory RHSA-2026:64771 available at https://access.redhat.com/errata/RHSA-2026:64771. Patch status is confirmed by the vendor advisory. No alternative mitigations are indicated.