CVE-2026-11770: 389-ds-base: 389-ds-base: pre-auth ldap filter injection in cleanallruv status check

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-31 · updated 2026-10-08
Weakness: CWE-90

Description

A flaw was found in 389 Directory Server. An unauthenticated remote attacker can inject LDAP search filters into the CleanAllRUV replication status-check extended operation. Because the handler performs the search against cn=config with elevated replication plugin privileges and returns a boolean match result, the attacker can extract sensitive server configuration metadata, including replication bind DNs and password storage scheme information.

Affected products

Red Hat 389 Directory Server: all versions
RedHat Directory Server: 11.0, 12.0, 13.0
Red Hat Enterprise Linux: 7.0, 8.0, 9.0, 10.0

References

Get alerted when CVE-2026-11770 or the next vulnerability affects your stack