CVE-2026-19843: 389-ds-base: 389-ds-base: command injection via unescaped ldap dn in cockpit 389 console ldap editor

Severity: high (CVSS 8.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-07 · updated 2026-10-08
Weakness: CWE-78

Description

A flaw was found in 389-ds-base. The Cockpit 389 Console's LDAP editor constructs an ldapsearch command by embedding an LDAP entry's distinguished name (DN) into a shell command string without proper escaping. An LDAP user with delegated privileges to create or rename directory entries could craft a malicious DN containing shell metacharacters. When a Cockpit administrator subsequently views the entry in the 389 Console, the embedded shell command executes with root privileges on the directory server host.

Affected products

Red Hat Directory Server 11: all versions
Red Hat Directory Server 11.5 E4S for RHEL 8: all versions — fixed in 8060020260908152739.0ca98e7e
Red Hat Directory Server 11.7 E4S for RHEL 8: all versions — fixed in 8080020260903102346.f969626e
Red Hat Directory Server 11.9 for RHEL 8: all versions — fixed in 8100020260904171440.37ed7c03
Red Hat Directory Server 12: all versions
Red Hat Directory Server 12.2 E4S for RHEL 9: all versions — fixed in 9020020260903155914.1674d574
Red Hat Directory Server 12.4 E4S for RHEL 9: all versions — fixed in 9040020260903102623.1674d574
Red Hat Directory Server 12.6 EUS for RHEL 9: all versions — fixed in 9060020260903100230.1674d574
Red Hat Directory Server 12.8 for RHEL 9: all versions — fixed in 9080020260908092641.1674d574
Red Hat Directory Server 13.0 EUS for RHEL 10: all versions — fixed in 0:3.0.6-4.el10dsrv
Red Hat Directory Server 13.2 for RHEL 10: all versions — fixed in 0:3.2.0-7.el10dsrv
Red Hat Enterprise Linux 10: all versions
Red Hat Enterprise Linux 8: all versions
Red Hat Enterprise Linux 9: all versions

How to fix

Upgrade to a fixed version: Red Hat Directory Server 11.5 E4S for RHEL 8 8060020260908152739.0ca98e7e; Red Hat Directory Server 11.7 E4S for RHEL 8 8080020260903102346.f969626e; Red Hat Directory Server 11.9 for RHEL 8 8100020260904171440.37ed7c03; Red Hat Directory Server 12.2 E4S for RHEL 9 9020020260903155914.1674d574; Red Hat Directory Server 12.4 E4S for RHEL 9 9040020260903102623.1674d574; Red Hat Directory Server 12.6 EUS for RHEL 9 9060020260903100230.1674d574; Red Hat Directory Server 12.8 for RHEL 9 9080020260908092641.1674d574; Red Hat Directory Server 13.0 EUS for RHEL 10 0:3.0.6-4.el10dsrv; Red Hat Directory Server 13.2 for RHEL 10 0:3.2.0-7.el10dsrv. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-19843 or the next vulnerability affects your stack