CVE-2026-19404: Missing Authorization in Red Hat Red Hat Directory Server 11
CVE-2026-19404 is a medium severity vulnerability in Red Hat Directory Server 11 (389 Directory Server) where the CleanAllRUV and Abort CleanAllRUV replication-maintenance extended operations lack authorization checks. This flaw allows unauthenticated remote attackers to invoke these operations if anonymous access is enabled (the default), or any authenticated user regardless of privilege to invoke them otherwise. Exploitation can remove replica IDs from replication metadata, purge changelog records, and interrupt administrator cleanup processes, potentially causing replication inconsistency or unavailability.
AI Analysis
Technical Summary
The vulnerability in 389 Directory Server involves missing authorization checks on the CleanAllRUV and Abort CleanAllRUV replication-maintenance extended operations. When the nsslapd-allow-anonymous-access setting is enabled (default), unauthenticated remote attackers can invoke these operations. If anonymous access is disabled, any authenticated user, regardless of privilege level, can still invoke them due to the lack of internal authorization checks. This enables attackers to remove replica IDs from replication metadata, purge changelog records, and disrupt administrator-initiated cleanup, which can lead to replication inconsistencies or service unavailability. The vulnerability has a CVSS 3.1 base score of 6.5 (medium severity) with network attack vector, low attack complexity, no privileges required, and no user interaction needed. No official patch or fix is currently confirmed. Interim mitigations include setting nsslapd-allow-anonymous-access to rootdse or off to block unauthenticated exploitation and restricting replication LDAP ports to trusted networks. The vendor advisory is the authoritative source for remediation status.
Potential Impact
An attacker able to reach the LDAP listener can invoke replication-maintenance operations without authorization, allowing removal of replica IDs from replication metadata, purging of changelog records, and interruption of cleanup processes. This can cause replication to become inconsistent or unavailable, impacting data integrity and availability. The flaw affects confidentiality minimally (no direct data disclosure), but impacts integrity and availability with low to moderate severity.
Mitigation Recommendations
No official patch or fix is currently confirmed by Red Hat. Interim mitigations recommended by Red Hat include setting the nsslapd-allow-anonymous-access configuration to rootdse or off to prevent unauthenticated clients from exploiting the flaw. However, this does not prevent exploitation by any authenticated user, as the vulnerable operations do not perform authorization checks. Additionally, restricting replication LDAP ports to trusted networks is advised as a defense-in-depth measure pending a code fix. Monitor Red Hat's advisory for updates on official patches or fixes.
CVE-2026-19404: Missing Authorization in Red Hat Red Hat Directory Server 11
Description
CVE-2026-19404 is a medium severity vulnerability in Red Hat Directory Server 11 (389 Directory Server) where the CleanAllRUV and Abort CleanAllRUV replication-maintenance extended operations lack authorization checks. This flaw allows unauthenticated remote attackers to invoke these operations if anonymous access is enabled (the default), or any authenticated user regardless of privilege to invoke them otherwise. Exploitation can remove replica IDs from replication metadata, purge changelog records, and interrupt administrator cleanup processes, potentially causing replication inconsistency or unavailability.
CVSS v3.1
Score 6.5medium
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in 389 Directory Server involves missing authorization checks on the CleanAllRUV and Abort CleanAllRUV replication-maintenance extended operations. When the nsslapd-allow-anonymous-access setting is enabled (default), unauthenticated remote attackers can invoke these operations. If anonymous access is disabled, any authenticated user, regardless of privilege level, can still invoke them due to the lack of internal authorization checks. This enables attackers to remove replica IDs from replication metadata, purge changelog records, and disrupt administrator-initiated cleanup, which can lead to replication inconsistencies or service unavailability. The vulnerability has a CVSS 3.1 base score of 6.5 (medium severity) with network attack vector, low attack complexity, no privileges required, and no user interaction needed. No official patch or fix is currently confirmed. Interim mitigations include setting nsslapd-allow-anonymous-access to rootdse or off to block unauthenticated exploitation and restricting replication LDAP ports to trusted networks. The vendor advisory is the authoritative source for remediation status.
Potential Impact
An attacker able to reach the LDAP listener can invoke replication-maintenance operations without authorization, allowing removal of replica IDs from replication metadata, purging of changelog records, and interruption of cleanup processes. This can cause replication to become inconsistent or unavailable, impacting data integrity and availability. The flaw affects confidentiality minimally (no direct data disclosure), but impacts integrity and availability with low to moderate severity.
Mitigation Recommendations
No official patch or fix is currently confirmed by Red Hat. Interim mitigations recommended by Red Hat include setting the nsslapd-allow-anonymous-access configuration to rootdse or off to prevent unauthenticated clients from exploiting the flaw. However, this does not prevent exploitation by any authenticated user, as the vulnerable operations do not perform authorization checks. Additionally, restricting replication LDAP ports to trusted networks is advised as a defense-in-depth measure pending a code fix. Monitor Red Hat's advisory for updates on official patches or fixes.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- redhat
- Date Reserved
- 2026-08-10T07:55:45.246Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-19404","vendor":"Red Hat"}]
Threat ID: 6a79c988bf8831d539b0ea47
Added to database: 08/10/2026, 12:52:24 UTC
Last enriched: 08/10/2026, 12:52:56 UTC
Last updated: 08/10/2026, 15:40:59 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.