CVE-2026-11770
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk50th percentile - higher than 50% of all known CVEs
Summary
A flaw was found in 389 Directory Server where an unauthenticated remote attacker can inject LDAP search filters into the CleanAllRUV operation. Because the query runs with elevated privileges, the attacker can extract sensitive server configuration metadata, including replication bind DNs and password storage scheme information.
Risk Assessment
An attacker can obtain sensitive LDAP server configuration data, potentially facilitating further attacks on the directory infrastructure.
Recommendation
Update 389 Directory Server to a patched version and restrict access to replication operations to trusted networks.
Other vulnerabilities in 389 Directory Server
See all- CVE-2015-1854High
389 Directory Server before 1.3.3.10 allows attackers to bypass intended access restrictions and modify directory entries via a crafted ldapmodrdn call.
- CVE-2016-5416High
389 Directory Server in Red Hat Enterprise Linux 6 and 7 allows remote attackers to read the default Access Control Instructions.
- CVE-2016-4992High
The 389 Directory Server in Red Hat Enterprise Linux 6 and 7 allows remote attackers to infer the existence of RDN component objects.
- CVE-2016-0741High
In 389 Directory Server (formerly Fedora Directory Server) versions 1.3.4.x before 1.3.4.7, a vulnerability allows remote attackers to cause a denial of service through an abnormally closed connection, leading to an infinite loop and connection blocking.
- CVE-2015-3230High
389 Directory Server (formerly Fedora Directory Server) before version 1.3.3.12 does not enforce the nsSSL3Ciphers preference when creating an sslSocket, allowing remote attackers to use a disabled cipher.
- CVE-2016-5405Critical
The 389 Directory Server in Red Hat Enterprise Linux (Desktop, HPC Node, Server, Workstation) versions 6 and 7 allows remote attackers to obtain user passwords.
- CVE-2026-19404Medium
A flaw was found in 389 Directory Server. The CleanAllRUV and Abort CleanAllRUV replication-maintenance extended operations perform no authorization check, allowing an unauthenticated remote attacker to invoke them when nsslapd-allow-anonymous-access is enabled (the default), or any authenticated low-privilege user to invoke them otherwise. This allows removal of a replica ID from replication metadata, purging of changelog records, and interruption of administrator-initiated cleanup, which can leave replication inconsistent or unavailable.
- CVE-2026-18651Medium
389 Directory Server has a vulnerability in SASL PLAIN authentication. The server installs connection-level bind credentials before performing the account-lock check. If the account is locked, the bind is reported as failed, but the authenticated state on the connection is not reverted. A client with valid credentials for a locked account can continue to use the connection with that account's privileges.
- CVE-2026-15722High
A stack buffer overflow flaw was found in 389 Directory Server (389-ds-base) in the get_ruvelement_from_berval() function. A remote unauthenticated attacker can send a crafted StartNSDS50ReplicationRequest with a replica ID field containing more than 16 digit characters, causing a crash of the LDAP server.
- CVE-2026-15041Low
In 389 Directory Server, the PBKDF2-SHA256 password verification function uses standard memcmp() instead of a constant-time comparison function. This allows a remote attacker to potentially infer partial hash information by measuring response times of LDAP bind requests.
Original NVD description (English source)
A flaw was found in 389 Directory Server. An unauthenticated remote attacker can inject LDAP search filters into the CleanAllRUV replication status-check extended operation. Because the handler performs the search against cn=config with elevated replication plugin privileges and returns a boolean match result, the attacker can extract sensitive server configuration metadata, including replication bind DNs and password storage scheme information.