CVE-2026-19843: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in Red Hat Red Hat Directory Server 11.5 E4S for RHEL 8

This vulnerability affects 389-ds-base used in Red Hat Directory Server. The Cockpit 389 Console's LDAP editor constructs an ldapsearch shell command by embedding an LDAP entry's DN without proper escaping, allowing an LDAP user with delegated privileges to create or rename directory entries to inject shell commands. When a Cockpit administrator views the malicious entry, the embedded shell command executes with root privileges on the directory server host, leading to potential full system compromise.

Successful exploitation results in execution of arbitrary commands with root privileges on the directory server host. This can lead to complete system compromise, including confidentiality, integrity, and availability impacts. The CVSS 3.1 score is 8.4 (High), reflecting network attack vector, low attack complexity, high privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.

Red Hat has released an official security update fixing this vulnerability in 389-ds-base as part of Red Hat Directory Server 13.2 for RHEL 10. Users should apply the update as described in the Red Hat advisory RHSA-2026:64768. The vendor advisory provides detailed instructions for applying the patch. No other mitigation is indicated or required once the update is applied.