A flaw was found in 389-ds-base. The Cockpit 389 Console's LDAP editor constructs an ldapsearch command by embedding an LDAP entry's distinguished name (DN) into a shell command string without proper escaping. An LDAP user with delegated privileges to create or rename directory entries could craft a malicious DN containing shell metacharacters. When a Cockpit administrator subsequently views the entry in the 389 Console, the embedded shell command executes with root privileges on the directory server host.

suse_linux SUSE-SU-2026:4380-1: SUSE SLES15 : Security update for 389-ds (Critical) (SUSE-SU-2026:4380-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21950-1 advisory.

    - CVE-2026-11770: pre-auth LDAP filter injection in CleanAllRUV status check (bsc#1273133).
    - CVE-2026-18355: heap buffer overflow in the SASL I/O layer allows a remote authenticated attacker to     cause a denial of       service or potentially achieve remote code execution (bsc#1279864).
    - CVE-2026-18453: 389-ds-base: 389-ds-base: pre-authentication NULL pointer dereference via paged results     and       USE_ONE_BACKEND control in op_shared_search (bsc#1279572).
    - CVE-2026-18922: stale identity carried in a Cyrus SASL auxiliary property during SASL PLAIN     authentication allows       unauthenticated attackers to achieve privilege escalation to Directory Manager (bsc#1279865).
    - CVE-2026-19843: unescaped LDAP DN in Cockpit 389 Console LDAP editor allows an LDAP user with delegated     privileges to       execute shell commands with root privileges on the directory server host (bsc#1279866).
    - CVE-2026-76560: incorrect matching in the SELFDN ACI bind-rule evaluator allows an anonymous LDAP client     to bypass       access controls on directory entries containing empty SELFDN attributes (bsc#1279867).

    Changes for 389-ds:

    - Update to version 3.0.7~git2.2846d5288:

     * Issue 7757 - stack-buffer-overflow caused by slapi_attr_init_syntax() (#7759)
     * Issue 7796 - A large received replicaID can overflow the storage buffer (#7797)
     * Issue 7041 - Add WebUI test for group member management (#7111)
     * Issue 7808 - CI - harden online_import_nosync_test (#7809)
     * Issue 7611 - PBKDF2 password verification should reject invalid iteration counts (#7632) (#7812)
     * [Backport 389-ds-base-3.0] Update rust-dependencies (#7799)
     * Issue 7595 - Remove the nightly dedup gate and fix dispatched test runs
     * Fix expiration time check (#7718)
     * Issue 7774 - Add backport action (#7775)
     * Issue 7770 - Testimony failure in test_cleanruv_extop_security.py (#7771)
     * Issue 3082 - Add test389.topologies compatibility shim for backports (#7725)
     * Issue 7595 - Skip redundant CI runs to relieve the Actions queue (#7749)
     * Issue 7760 - CI - harden dsconf_task_test.py
     * Issue 4701 - Fix UAF when excluding attrs from retro changelog (#7730)
     * Issue 7723 - Range search returns an empty result when its start key is removed (#7724)
     * Issue 7639 - Move log compression outside of global write lock
     * Issue 7631 - Don't install bpftrace by default (#7726)
     * Issue 7735 - Heap overflow when parsing objectclass superior (#7736)
     * Issue 7733 - Typo about nsuniqueid in tombstone_to_conflict (#7734)
     * Issue 7707 - lib389: set nsDS5ReplicaBindDNGroup before ensure_agreement() in     join_supplier/hub/consumer (#7708)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 3f5c81ae-b227-11f1-a655-3497f65b111b advisory.

    The 389 Directory Server project reports:
    CVE-2026-11770: the replication extended operations did not                 verify that the bind DN is accepted by the replica, and the                 CleanRUV status filters were open to LDAP injection.
    CVE-2026-18355: a missing minimum length check in                 sasl_io_start_packet() lets an authenticated SASL user trigger                 an unsigned integer underflow, causing heap corruption and a                 crash of the server.
    CVE-2026-18453: op_shared_search() does not check for a NULL                 backend pointer when reusing a paged results slot, so an                 unauthenticated client can crash ns-slapd with two search                 requests on one connection. Paged results and anonymous access                 are enabled by default.
    CVE-2026-18922: a failed one-shot SASL exchange leaves stale                 identity data in the auxprop context, so a later successful                 bind on the same connection can inherit it and escalate to                 Directory Manager.
    CVE-2026-19843: the cockpit LDAP editor passed the entry DN                 into a shell command line, so a user who can create or rename                 an entry can have the host run commands as root when an                 administrator opens that entry.
    CVE-2026-76560: anonymous clients could satisfy SELFDN,                 USERDNATTR and LDAPURL ACL bind rules, granting unauthorized                 access.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:65375 advisory.

    Red Hat Directory Server is an LDAPv3-compliant directory server. The suite of packages includes the     Lightweight Directory Access Protocol (LDAP) server, as well as command-line utilities and Web UI packages     for server administration.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Directory Server 12.8 for RHEL 9     Release Notes linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:64793 advisory.

    Red Hat Directory Server is an LDAPv3-compliant directory server. The suite of packages includes the     Lightweight Directory Access Protocol (LDAP) server, as well as command-line utilities and Web UI packages     for server administration.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Directory Server 11.9 for RHEL 8     Release Notes linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:64780 advisory.

    Red Hat Directory Server is an LDAPv3-compliant directory server. The suite of packages includes the     Lightweight Directory Access Protocol (LDAP) server, as well as command-line utilities and Web UI packages     for server administration.

    Security Fix(es):

    * 389-ds-base: 389-ds-base: heap buffer overflow via SASL wrapped-record length lower-bound underflow in     sasl_io_start_packet() (CVE-2026-18355)

    * 389-ds-base: 389-ds-base: pre-authentication NULL pointer dereference via paged results and     USE_ONE_BACKEND control in op_shared_search (CVE-2026-18453)

    * 389-ds-base: 389-ds-base: SASL PLAIN authentication allows privilege escalation to Directory Manager via     stale identity in Cyrus SASL auxiliary property (CVE-2026-18922)

    * 389-ds-base: 389-ds-base: Command injection via unescaped LDAP DN in Cockpit 389 Console LDAP editor     (CVE-2026-19843)

    * 389-ds-base: 389-ds: anonymous LDAP client can defeat SELFDN ACI bind-rule checks via empty bind DN     (CVE-2026-76560)

    Bug Fix(es) and Enhancement(s):

    * lib389: set nsDS5ReplicaBindDNGroup before ensure_agreement() [dirsrv-12.4.z] (JIRA:DIRSRV-869)

    * fix breaks replication total init when nsDS5ReplicaBindDNGroup is set after agreement creation     [dirsrv-12.4.z] (JIRA:DIRSRV-901)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:64779 advisory.

    Red Hat Directory Server is an LDAPv3-compliant directory server. The suite of packages includes the     Lightweight Directory Access Protocol (LDAP) server, as well as command-line utilities and Web UI packages     for server administration.

    Security Fix(es):

    * 389-ds-base: 389-ds-base: heap buffer overflow via SASL wrapped-record length lower-bound underflow in     sasl_io_start_packet() (CVE-2026-18355)

    * 389-ds-base: 389-ds-base: pre-authentication NULL pointer dereference via paged results and     USE_ONE_BACKEND control in op_shared_search (CVE-2026-18453)

    * 389-ds-base: 389-ds-base: SASL PLAIN authentication allows privilege escalation to Directory Manager via     stale identity in Cyrus SASL auxiliary property (CVE-2026-18922)

    * 389-ds-base: 389-ds-base: Command injection via unescaped LDAP DN in Cockpit 389 Console LDAP editor     (CVE-2026-19843)

    * 389-ds-base: 389-ds: anonymous LDAP client can defeat SELFDN ACI bind-rule checks via empty bind DN     (CVE-2026-76560)

    Bug Fix(es) and Enhancement(s):

    * lib389: set nsDS5ReplicaBindDNGroup before ensure_agreement() [dirsrv-12.2.z] (JIRA:DIRSRV-868)

    * fix breaks replication total init when nsDS5ReplicaBindDNGroup is set after agreement creation     [dirsrv-12.2.z] (JIRA:DIRSRV-900)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:64782 advisory.

    Red Hat Directory Server is an LDAPv3-compliant directory server. The suite of packages includes the     Lightweight Directory Access Protocol (LDAP) server, as well as command-line utilities and Web UI packages     for server administration.

    Security Fix(es):

    * 389-ds-base: 389-ds-base: Command injection via unescaped LDAP DN in Cockpit 389 Console LDAP editor     (CVE-2026-19843)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:64769 advisory.

    389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the     Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Directory Server 13.0 EUS for RHEL 10     Release Notes linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:64792 advisory.

    Red Hat Directory Server is an LDAPv3-compliant directory server. The suite of packages includes the     Lightweight Directory Access Protocol (LDAP) server, as well as command-line utilities and Web UI packages     for server administration.

    Security Fix(es):

    * 389-ds-base: 389-ds-base: heap buffer overflow via SASL wrapped-record length lower-bound underflow in     sasl_io_start_packet() (CVE-2026-18355)

    * 389-ds-base: 389-ds-base: pre-authentication NULL pointer dereference via paged results and     USE_ONE_BACKEND control in op_shared_search (CVE-2026-18453)

    * 389-ds-base: 389-ds-base: SASL PLAIN authentication allows privilege escalation to Directory Manager via     stale identity in Cyrus SASL auxiliary property (CVE-2026-18922)

    * 389-ds-base: 389-ds-base: Command injection via unescaped LDAP DN in Cockpit 389 Console LDAP editor     (CVE-2026-19843)

    * 389-ds-base: 389-ds: anonymous LDAP client can defeat SELFDN ACI bind-rule checks via empty bind DN     (CVE-2026-76560)

    Bug Fix(es) and Enhancement(s):

    * lib389: set nsDS5ReplicaBindDNGroup before ensure_agreement() [dirsrv-11.7.z] (JIRA:DIRSRV-866)

    * fix breaks replication total init when nsDS5ReplicaBindDNGroup is set after agreement creation     [dirsrv-11.7.z] (JIRA:DIRSRV-898)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:64768 advisory.

    389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the     Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Directory Server 13.2 for RHEL 10     Release Notes linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in 389-ds-base. The Cockpit 389 Console's LDAP editor constructs an ldapsearch command by     embedding an LDAP entry's distinguished name (DN) into a shell command string without proper escaping. An     LDAP user with delegated privileges to create or rename directory entries could craft a malicious DN     containing shell metacharacters. When a Cockpit administrator subsequently views the entry in the 389     Console, the embedded shell command executes with root privileges on the directory server host.
    (CVE-2026-19843)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
350775	openSUSE 16 Security Update : 389-ds (openSUSE-SU-2026:21950-1)	Nessus	SuSE Local Security Checks	Local	critical
346907	FreeBSD : 389-ds-base -- multiple vulnerabilities (3f5c81ae-b227-11f1-a655-3497f65b111b)	Nessus	FreeBSD Local Security Checks	Local	critical
343880	RHEL 9 : redhat-ds:12 (RHSA-2026:65375)	Nessus	Red Hat Local Security Checks	Local	high
343798	RHEL 8 : redhat-ds:11 (RHSA-2026:64793)	Nessus	Red Hat Local Security Checks	Local	critical
343797	RHEL 9 : redhat-ds:12 (RHSA-2026:64780)	Nessus	Red Hat Local Security Checks	Local	critical
343768	RHEL 9 : redhat-ds:12 (RHSA-2026:64779)	Nessus	Red Hat Local Security Checks	Local	critical
343756	RHEL 9 : redhat-ds:12 (RHSA-2026:64782)	Nessus	Red Hat Local Security Checks	Local	high
343754	RHEL 10 : 389-ds-base (RHSA-2026:64769)	Nessus	Red Hat Local Security Checks	Local	high
343753	RHEL 8 : redhat-ds:11 (RHSA-2026:64792)	Nessus	Red Hat Local Security Checks	Local	critical
343750	RHEL 10 : 389-ds-base (RHSA-2026:64768)	Nessus	Red Hat Local Security Checks	Local	high
343492	Linux Distros Unpatched Vulnerability : CVE-2026-19843	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-19843

high

Tenable Plugins

Coming Soon

critical

critical

high

critical

critical

critical

high

high

critical

high

high