Executive brief
389 Directory Server is an enterprise-grade LDAP server used to manage user identities and system configurations. A security flaw allows an unauthenticated attacker to trick the server into revealing sensitive configuration data, such as internal account names and security settings. This information could be used to plan more advanced attacks against the organization's identity infrastructure.
Technical details
An LDAP injection vulnerability exists in the multisupplier_extop_cleanruv_check_status() handler within repl_extop.c of the 389 Directory Server. The component fails to sanitize attacker-supplied filters before passing them to an internal search against 'cn=config' using elevated replication plugin privileges. Because the operation returns a boolean match result, a remote, unauthenticated attacker can use it as a boolean oracle to exfiltrate sensitive metadata, including replication bind DNs and password storage schemes. The attack is possible via anonymous bind if 'nsslapd-allow-anonymous-access' is enabled.
Affected products
- 389 Project 389 Directory Server
- Red Hat Red Hat Directory Server 11
- Red Hat Red Hat Directory Server 12
- Red Hat Red Hat Directory Server 13
- Red Hat Red Hat Enterprise Linux 7 affected
Timeline
- 2026-04-22: other: Vulnerability discovered during security assessment
- 2026-06-04: other: Reported to Red Hat Bugzilla
- 2026-07-31: disclosed: CVE published