What’s Vulnerable › Vulnerabilities

CVE-2026-18922: 389-ds-base: 389-ds-base: sasl plain authentication allows privilege escalation to directory manager via stale identity in cyrus sasl auxiliary property

Description

A flaw was found in 389 Directory Server. During SASL PLAIN authentication, a stale identity carried in a Cyrus SASL auxiliary property from a prior failed bind attempt can be installed on a connection following a subsequent, unrelated successful bind, regardless of which SASL mechanism completes that second bind. An attacker can send a SASL PLAIN bind as cn=Directory Manager with an incorrect password, then complete a SASL ANONYMOUS bind on the same connection, causing the server to grant Directory Manager authority without any valid credentials. A variant using a valid low-privileged account's own successful bind instead of an anonymous one is also possible.

Affected products

How to fix

Upgrade to a fixed version: Red Hat Directory Server 11.5 E4S for RHEL 8 8060020260908152739.0ca98e7e; Red Hat Directory Server 11.7 E4S for RHEL 8 8080020260903102346.f969626e; Red Hat Directory Server 11.9 for RHEL 8 8100020260904171440.37ed7c03; Red Hat Directory Server 12.2 E4S for RHEL 9 9020020260903155914.1674d574; Red Hat Directory Server 12.4 E4S for RHEL 9 9040020260903102623.1674d574; Red Hat Enterprise Linux 10 0:3.2.0-10.el10_2; Red Hat Enterprise Linux 10.0 Extended Update Support 0:3.0.6-21.el10_0; Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION 0:1.2.11.15-97.el6_10.1; Red Hat Enterprise Linux 7 Extended Lifecycle Support 0:1.3.11.1-15.el7_9; Red Hat Enterprise Linux 8 8100020260904155442.25e700aa; Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support 8040020260901171549.96015a92; Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On 8040020260901171549.96015a92. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-18922 or the next vulnerability affects your stack