# CVE-2026-11770: 389 Directory Server LDAP injection in CleanAllRUV replication

Source: https://junglewise.ai/threats/cve-2026-11770-389-directory-server-ldap-injection-in-cleanallruv-replication  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-31. Updated: 2026-07-31  
License: CC BY 4.0 with a link back

CVE-2026-11770 · Severity: high · CVSS 7.5 · Published 2026-07-31

389 Directory Server is an enterprise-grade LDAP server used to manage user identities and system configurations. A security flaw allows an unauthenticated attacker to trick the server into revealing sensitive configuration data, such as internal account names and security settings. This information could be used to plan more advanced attacks against the organization's identity infrastructure.

## Quick answers

**Is CVE-2026-11770 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-11770 being exploited in the wild.

**How severe is CVE-2026-11770?** High severity, with a CVSS score of 7.5, published 31 July 2026.

**Which products and versions are affected?** 389 Project 389 Directory Server; Red Hat Red Hat Directory Server 11; Red Hat Red Hat Directory Server 12; Red Hat Red Hat Directory Server 13; and 1 more.

**Is there a fix for CVE-2026-11770?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-11770 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2026-11770?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An LDAP injection vulnerability exists in the multisupplier_extop_cleanruv_check_status() handler within repl_extop.c of the 389 Directory Server. The component fails to sanitize attacker-supplied filters before passing them to an internal search against 'cn=config' using elevated replication plugin privileges. Because the operation returns a boolean match result, a remote, unauthenticated attacker can use it as a boolean oracle to exfiltrate sensitive metadata, including replication bind DNs and password storage schemes. The attack is possible via anonymous bind if 'nsslapd-allow-anonymous-access' is enabled.

## Affected products

- 389 Project 389 Directory Server
- Red Hat Red Hat Directory Server 11
- Red Hat Red Hat Directory Server 12
- Red Hat Red Hat Directory Server 13
- Red Hat Red Hat Enterprise Linux 7 affected

## Timeline

- 2026-04-22: other: Vulnerability discovered during security assessment
- 2026-06-04: other: Reported to Red Hat Bugzilla
- 2026-07-31: disclosed: CVE published

## References

- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/security/cve/CVE-2026-11770](https://access.redhat.com/security/cve/CVE-2026-11770)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2484802](https://bugzilla.redhat.com/show_bug.cgi?id=2484802)
- [https://github.com/389ds/389-ds-base/blob/main/ldap/servers/plugins/replication/repl_extop.c](https://github.com/389ds/389-ds-base/blob/main/ldap/servers/plugins/replication/repl_extop.c)