389 ds base: A flaw was found in 389 Directory Server. (CVE-2026-76560)

The vulnerability CVE-2026-76560 in 389 Directory Server allows an anonymous LDAP client to bypass SELFDN ACI bind-rule checks if the target attribute can hold an empty value. This occurs because the bind-rule evaluator incorrectly treats an empty bind DN as matching an empty stored attribute value, enabling unauthorized modification or addition of directory entries that should be restricted to authenticated users. Red Hat Directory Server does not ship with vulnerable ACIs by default, so exploitation depends on specific configurations. A security update fixing this issue is available for Red Hat Enterprise Linux 7 Extended Lifecycle Support.

This vulnerability allows unauthorized LDAP clients to bypass access control checks and modify or add directory entries that should be restricted to authenticated users. The impact is configuration-dependent because Red Hat Directory Server does not include vulnerable ACIs by default. The CVSS v3.1 score is 7.5 (High), indicating a significant risk of unauthorized integrity modification without authentication or user interaction.

A security update addressing this vulnerability is available for Red Hat Enterprise Linux 7 Extended Lifecycle Support. Users should apply the official Red Hat update as detailed in the Red Hat advisory RHSA-2026:64771. Since the vulnerability depends on specific ACI configurations, reviewing and tightening access control instructions to avoid empty attribute values in bind-rule checks is also recommended. Patch status is confirmed by the vendor advisory.