LDAP Vulnerability in 389 Directory Server from Red Hat
CVE-2026-76560

7.5HIGH

Key Information:

Vendor

Red Hat
Status
Red Hat Directory Server 11
Red Hat Directory Server 12
Red Hat Directory Server 13
Red Hat Enterprise Linux 10
Vendor
CVE Published:
7 September 2026

What is CVE-2026-76560?

A security flaw exists in the 389 Directory Server where the SELFDN ACI bind-rule evaluator improperly allows an anonymous LDAP client to match an empty bind DN against a stored empty attribute. This misconfiguration permits an unauthenticated client to pass access control checks, granting unauthorized operations such as adding or modifying directory entries, which should be restricted to specific authenticated users. Addressing this vulnerability is critical to maintaining the integrity of directory access controls in a secure environment.

References

https://access.redhat.com/security/cve/CVE-2026-76560
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2519521
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank Gia Bui (yabeow) (Calif.io) for reporting this issue.
.