# CVE-2026-19843: 389 Directory Server command injection via LDAP DN in Cockpit console Source: https://junglewise.ai/threats/cve-2026-19843-389-directory-server-command-injection-via-ldap-dn-in-cockpit Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Published: 2026-09-07. Updated: 2026-09-26 License: CC BY 4.0 with a link back CVE-2026-19843 · Severity: high · CVSS 8.4 · Published 2026-09-07 389 Directory Server is an LDAP server used to manage directory information in enterprise environments. The Cockpit 389 Console, an administrative tool for managing LDAP entries, fails to properly escape distinguished names (DN) when constructing shell commands. An LDAP user with delegated entry creation or renaming privileges could inject shell metacharacters into a DN, causing arbitrary code execution with root privileges when an administrator views the malicious entry in the console. Vendors: [Red Hat](https://junglewise.ai/threats/vendors/red-hat). ## Quick answers **Is CVE-2026-19843 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-19843 being exploited in the wild. **How severe is CVE-2026-19843?** High severity, with a CVSS score of 8.4, published 7 September 2026. **Which products and versions are affected?** Red Hat Cockpit 389 Console before 3.2.0-7.el10dsrv. **Is there a fix for CVE-2026-19843?** A patch was published on 2026-09-08: Red Hat issued RHSA-2026:64768 with patched 389-ds-base 3.2.0-7.el10dsrv Junglewise finds every place you run it, drafts the upgrade and applies it once you approve. **How is CVE-2026-19843 attacked?** It is attacked with local access. **Am I affected by CVE-2026-19843?** Check whether you run Red Hat Cockpit 389 Console at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you. ## Technical details The vulnerability is a command injection flaw in the LDAP editor component of Cockpit 389 Console. The vulnerable code constructs an ldapsearch command by embedding an LDAP DN directly into a shell command string without proper escaping or quoting. An attacker with delegated LDAP privileges (ability to create or rename directory entries) can craft a malicious DN containing shell metacharacters (e.g., backticks, $(), pipes, semicolons). When a Cockpit administrator subsequently views the crafted entry in the 389 Console, the ldapsearch command executes with root privileges on the directory server host. The attack requires prior LDAP access but no network traversal to the management interface itself. A patch is available in 389-ds-base version 3.2.0-7.el10dsrv and later for Red Hat Directory Server 13. ## Affected products - Red Hat 389 Directory Server before 3.2.0-7.el10dsrv - Red Hat Cockpit 389 Console before 3.2.0-7.el10dsrv ## Timeline - 2026-09-07: disclosed - 2026-09-08: patched: Red Hat issued RHSA-2026:64768 with patched 389-ds-base 3.2.0-7.el10dsrv ## References - [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/) - [https://access.redhat.com/errata/RHSA-2026:64768](https://access.redhat.com/errata/RHSA-2026:64768)