CVE-2026-19843highCWE-78

CVE-2026-19843: high-severity vulnerability in Red Hat Directory Server 11

389-ds-base: 389-ds-base: command injection via unescaped ldap dn in cockpit 389 console ldap editor

Published · Updated

Follow this CVE+ Monitor Red Hat Enterprise Linux+ Monitor Red Hat Directory Server

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

41Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 8.4epss 0.5%
from disclosure to weaponsame day
Published on NVDSep 7
1st PoCAug 24
A flaw was found in 389-ds-base. The Cockpit 389 Console's LDAP editor constructs an ldapsearch command by embedding an LDAP entry's distinguished name (DN) into a shell command string without proper escaping. An LDAP user with delegated privileges to create or rename directory entries could craft a malicious DN containing shell metacharacters. When a Cockpit administrator subsequently views the entry in the 389 Console, the embedded shell command executes with root privileges on the directory server host.
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
Affected products
Red Hat · Red Hat Directory Server 11Red Hat · Red Hat Directory Server 11.5 E4S for RHEL 8Red Hat · Red Hat Directory Server 11.7 E4S for RHEL 8Red Hat · Red Hat Directory Server 11.9 for RHEL 8Red Hat · Red Hat Directory Server 12Red Hat · Red Hat Directory Server 12.2 E4S for RHEL 9Red Hat · Red Hat Directory Server 12.4 E4S for RHEL 9Red Hat · Red Hat Directory Server 12.6 EUS for RHEL 9Red Hat · Red Hat Directory Server 12.8 for RHEL 9Red Hat · Red Hat Directory Server 13.0 EUS for RHEL 10Red Hat · Red Hat Directory Server 13.2 for RHEL 10Red Hat · Red Hat Enterprise Linux 10Red Hat · Red Hat Enterprise Linux 6Red Hat · Red Hat Enterprise Linux 7Red Hat · Red Hat Enterprise Linux 8Red Hat · Red Hat Enterprise Linux 9
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Red Hat Directory Server 11

In the same product, most dangerous first.

CVE-2025-14905HIGH389-ds-base: 389-ds-base: remote code execution and denial of service via heap buffer overflowEPSS 1.3%CVE-2024-3657HIGH389-ds-base: potential denial of service via specially crafted kerberos as-req requestEPSS 1.3%CVE-2024-6237MEDIUM389-ds-base: unauthenticated user can trigger a dos by sending a specific extended search requestEPSS 0.9%CVE-2026-18453HIGH389-ds-base: 389-ds-base: pre-authentication null pointer dereference via paged results and use_one_backend control in op_shared_searchEPSS 0.8%CVE-2026-18355HIGH389-ds-base: 389-ds-base: heap buffer overflow via sasl wrapped-record length lower-bound underflow in sasl_io_start_packet()EPSS 0.8%CVE-2026-15722HIGH389-ds-base: 389-ds-base: pre-authentication stack buffer overflow in get_ruvelement_from_berval() via unbounded replica id parsingEPSS 0.8%