CVE-2026-18651: 389-ds-base: 389-ds-base: sasl plain bind installs connection credentials before account-lock check, allowing continued access as a locked account

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-03 · updated 2026-08-09
Weakness: CWE-287

Description

A flaw was found in 389 Directory Server. During SASL PLAIN authentication, the server installs connection-level bind credentials before performing the account-lock check. If the account is subsequently found to be locked, the bind is reported as failed to the client, but the already-installed authenticated state on the connection is not reverted. A client that supplies valid credentials for an account that has been administratively locked can continue to use the same connection with that account's privileges, defeating account lock as an access-revocation control.

Affected products

Red Hat 389 Directory Server: all versions
RedHat Directory Server: 11.0, 12.0, 13.0
Red Hat Enterprise Linux: 7.0, 8.0, 9.0, 10.0

References

Get alerted when CVE-2026-18651 or the next vulnerability affects your stack