LDAP Search Filter Injection Vulnerability in 389 Directory Server by Red Hat
CVE-2026-11770

7.5HIGH

Key Information:

Vendor: Red Hat
Status: Red Hat Directory Server 11; Red Hat Directory Server 12; Red Hat Directory Server 13; Red Hat Enterprise Linux 10
Vendor: CVE Published:; 31 July 2026

What is CVE-2026-11770?

A vulnerability exists in Red Hat's 389 Directory Server that allows unauthenticated remote attackers to inject malicious LDAP search filters into the CleanAllRUV replication status-check operation. This flaw enables attackers to exploit the elevated privileges of the replication plugin, allowing them to access sensitive server configuration details. By conducting this injection, attackers can retrieve critical data such as replication bind DNs and the specifics of the password storage scheme, potentially leading to further exploitation of the affected system.