Log in / Sign up

Vulnerability details

CVE-2026-18922

Red Hat Directory Server 12

389-ds-base: 389-ds-base: sasl plain authentication allows privilege escalation to directory manager via stale identity in cyrus sasl auxiliary property

CVSS 3.1
9.8Critical

Official description

A flaw was found in 389 Directory Server. During SASL PLAIN authentication, a stale identity carried in a Cyrus SASL auxiliary property from a prior failed bind attempt can be installed on a connection following a subsequent, unrelated successful bind, regardless of which SASL mechanism completes that second bind. An attacker can send a SASL PLAIN bind as cn=Directory Manager with an incorrect password, then complete a SASL ANONYMOUS bind on the same connection, causing the server to grant Directory Manager authority without any valid credentials. A variant using a valid low-privileged account's own successful bind instead of an anonymous one is also possible.

CVSS scores

ScoreVersionSourceVector
9.8Critical 3.1 CVEProject cvelistV5 (CNA) (redhat) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

VendorProductVersionsSource
Red Hat Red Hat Directory Server 12 All CVEProject cvelistV5 (CNA)

References and advisories

19
Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published
2026-09-07
Last updated
2026-10-08
State
Published
Assigner (CNA)
redhat

Exploit prediction (EPSS)

0.56%
Probability of exploitation in 30 days
46.8%
Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable
No
Exploitation
None
Technical impact
Total

Weaknesses (CWE)

  • CWE-287
    Improper Authentication