SASL PLAIN Authentication Vulnerability in 389 Directory Server by Red Hat
CVE-2026-18922

9.8CRITICAL

Key Information:

Vendor: Red Hat
Status: Red Hat Directory Server 11.7 E4s For Rhel 8; Red Hat Directory Server 11.9 For Rhel 8; Red Hat Directory Server 12.2 E4s For Rhel 9; Red Hat Directory Server 12.4 E4s For Rhel 9
Vendor: CVE Published:; 7 September 2026

What is CVE-2026-18922?

A serious security flaw has been identified within the 389 Directory Server, where an attacker can exploit the SASL PLAIN authentication method. During the authentication process, a stale identity associated with a failed bind attempt can improperly carry over into a new, unrelated successful bind. This vulnerability allows an attacker to utilize an incorrect password with the ‘cn=Directory Manager’ bind and subsequently, through a valid SASL ANONYMOUS bind on the same connection, gain unauthorized Directory Manager privileges without presenting valid credentials. Additionally, there exists a variant of this issue that permits the exploitation of a successful bind using valid low-privileged account credentials, amplifying the risk of unauthorized access significantly.