LDAP Vulnerability in 389 Directory Server from Red Hat
CVE-2026-76560

7.5HIGH

Key Information:

Vendor

Red Hat
Status
Red Hat Directory Server 11.7 E4s For Rhel 8
Red Hat Directory Server 11.9 For Rhel 8
Red Hat Directory Server 12.2 E4s For Rhel 9
Red Hat Directory Server 12.4 E4s For Rhel 9
Vendor
CVE Published:
7 September 2026

What is CVE-2026-76560?

A security flaw exists in the 389 Directory Server where the SELFDN ACI bind-rule evaluator improperly allows an anonymous LDAP client to match an empty bind DN against a stored empty attribute. This misconfiguration permits an unauthenticated client to pass access control checks, granting unauthorized operations such as adding or modifying directory entries, which should be restricted to specific authenticated users. Addressing this vulnerability is critical to maintaining the integrity of directory access controls in a secure environment.

Affected Version(s)

Red Hat Directory Server 11.7 E4S for RHEL 8 8080020260903102346.f969626e

Red Hat Directory Server 11.9 for RHEL 8 8100020260904171440.37ed7c03

Red Hat Directory Server 12.2 E4S for RHEL 9 9020020260903155914.1674d574

References

https://access.redhat.com/errata/RHSA-2026:64771
vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:64776
vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:64778
vendor-advisoryx_refsource_REDHAT

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank Gia Bui (yabeow) (Calif.io) for reporting this issue.
.