Read the docs
TI-2026-16091 Aliases CVE-2026-19843GHSA-p34m-7cj2-q64p

389-ds-base: 389-ds-base: command injection via unescaped ldap dn in cockpit 389 console ldap editor

Priority LOW 39CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 9 fixed, 6 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-78.

Summary

A flaw was found in 389-ds-base. The Cockpit 389 Console's LDAP editor constructs an ldapsearch command by embedding an LDAP entry's distinguished name (DN) into a shell command string without proper escaping. An LDAP user with delegated privileges to create or rename directory entries could craft a malicious DN containing shell metacharacters. When a Cockpit administrator subsequently views the entry in the 389 Console, the embedded shell command executes with root privileges on the directory server host.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0048 41st percentileScored 2026-11-07
Fix Partial Red Hat: 9 advisoriesRed Hat: 9 fixed, 6 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red HatRed Hat Directory Server 11.5 E4S for RHEL 8—8060020260908152739.0ca98e7ePatch availableCNA
Red HatRed Hat Directory Server 11.7 E4S for RHEL 8—8080020260903102346.f969626ePatch availableCNA
Red HatRed Hat Directory Server 11.9 for RHEL 8—8100020260904171440.37ed7c03Patch availableCNA
Red HatRed Hat Directory Server 12.2 E4S for RHEL 9—9020020260903155914.1674d574Patch availableCNA
Red HatRed Hat Directory Server 12.4 E4S for RHEL 9—9040020260903102623.1674d574Patch availableCNA
Red HatRed Hat Directory Server 12.6 EUS for RHEL 9—9060020260903100230.1674d574Patch availableCNA
Red HatRed Hat Directory Server 12.8 for RHEL 9—9080020260908092641.1674d574Patch availableCNA
Red HatRed Hat Directory Server 13.0 EUS for RHEL 10—3.0.6-4.el10dsrvPatch availableCNA
Red HatRed Hat Directory Server 13.2 for RHEL 10—3.2.0-7.el10dsrvPatch availableCNA
Red HatRed Hat Directory Server 11——No fix listedCNA
Red HatRed Hat Directory Server 12——No fix listedCNA
Red HatRed Hat Enterprise Linux 10——No fix listedCNA
Red HatRed Hat Enterprise Linux 6——No fix listedCNA
Red HatRed Hat Enterprise Linux 7——Not affectedCNA
Red HatRed Hat Enterprise Linux 8——No fix listedCNA
Red HatRed Hat Enterprise Linux 8——Not affectedCNA
Red HatRed Hat Enterprise Linux 9——No fix listedCNA
  • Red Hat Directory Server 11.5 E4S for RHEL 8 VendorRed Hat Affected — Fixed in 8060020260908152739.0ca98e7e Patch available CNA
  • Red Hat Directory Server 11.7 E4S for RHEL 8 VendorRed Hat Affected — Fixed in 8080020260903102346.f969626e Patch available CNA
  • Red Hat Directory Server 11.9 for RHEL 8 VendorRed Hat Affected — Fixed in 8100020260904171440.37ed7c03 Patch available CNA
  • Red Hat Directory Server 12.2 E4S for RHEL 9 VendorRed Hat Affected — Fixed in 9020020260903155914.1674d574 Patch available CNA
  • Red Hat Directory Server 12.4 E4S for RHEL 9 VendorRed Hat Affected — Fixed in 9040020260903102623.1674d574 Patch available CNA
  • Red Hat Directory Server 12.6 EUS for RHEL 9 VendorRed Hat Affected — Fixed in 9060020260903100230.1674d574 Patch available CNA
  • Red Hat Directory Server 12.8 for RHEL 9 VendorRed Hat Affected — Fixed in 9080020260908092641.1674d574 Patch available CNA
  • Red Hat Directory Server 13.0 EUS for RHEL 10 VendorRed Hat Affected — Fixed in 3.0.6-4.el10dsrv Patch available CNA
  • Red Hat Directory Server 13.2 for RHEL 10 VendorRed Hat Affected — Fixed in 3.2.0-7.el10dsrv Patch available CNA
  • Red Hat Directory Server 11 VendorRed Hat Affected — Fixed in — No fix listed CNA
  • Red Hat Directory Server 12 VendorRed Hat Affected — Fixed in — No fix listed CNA
  • Red Hat Enterprise Linux 10 VendorRed Hat Affected — Fixed in — No fix listed CNA
  • Red Hat Enterprise Linux 6 VendorRed Hat Affected — Fixed in — No fix listed CNA
  • Red Hat Enterprise Linux 7 VendorRed Hat Affected — Fixed in — Not affected CNA
  • Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in — No fix listed CNA
  • Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in — Not affected CNA
  • Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in — No fix listed CNA

CPE names CNA · 16

CPEVersionsRoleVendor
cpe:/a:redhat:directory_server_e4s:11.5::el811.5—Red Hat
cpe:/a:redhat:directory_server_e4s:11.7::el811.7—Red Hat
cpe:/a:redhat:directory_server:11.9::el811.9—Red Hat
cpe:/a:redhat:directory_server_e4s:12.2::el912.2—Red Hat
cpe:/a:redhat:directory_server_e4s:12.4::el912.4—Red Hat
cpe:/a:redhat:directory_server_eus:12.6::el912.6—Red Hat
cpe:/a:redhat:directory_server:12.8::el912.8—Red Hat
cpe:/a:redhat:directory_server_e2s:13.0::el1013.0—Red Hat
cpe:/a:redhat:directory_server:13.2::el1013.2—Red Hat
cpe:/a:redhat:directory_server:1111—Red Hat
  • cpe:/a:redhat:directory_server_e4s:11.5::el8 Versions 11.5 — ·Red Hat
  • cpe:/a:redhat:directory_server_e4s:11.7::el8 Versions 11.7 — ·Red Hat
  • cpe:/a:redhat:directory_server:11.9::el8 Versions 11.9 — ·Red Hat
  • cpe:/a:redhat:directory_server_e4s:12.2::el9 Versions 12.2 — ·Red Hat
  • cpe:/a:redhat:directory_server_e4s:12.4::el9 Versions 12.4 — ·Red Hat
  • cpe:/a:redhat:directory_server_eus:12.6::el9 Versions 12.6 — ·Red Hat
  • cpe:/a:redhat:directory_server:12.8::el9 Versions 12.8 — ·Red Hat
  • cpe:/a:redhat:directory_server_e2s:13.0::el10 Versions 13.0 — ·Red Hat
  • cpe:/a:redhat:directory_server:13.2::el10 Versions 13.2 — ·Red Hat
  • cpe:/a:redhat:directory_server:11 Versions 11 — ·Red Hat
Show 6 more CPE
CPEVersionsRoleVendor
cpe:/a:redhat:directory_server:1212—Red Hat
cpe:/a:redhat:enterprise_linux:1010—Red Hat
cpe:/o:redhat:rhel_els:66—Red Hat
cpe:/o:redhat:rhel_els:77—Red Hat
cpe:/a:redhat:enterprise_linux:88—Red Hat
cpe:/a:redhat:enterprise_linux:99—Red Hat
  • cpe:/a:redhat:directory_server:12 Versions 12 — ·Red Hat
  • cpe:/a:redhat:enterprise_linux:10 Versions 10 — ·Red Hat
  • cpe:/o:redhat:rhel_els:6 Versions 6 — ·Red Hat
  • cpe:/o:redhat:rhel_els:7 Versions 7 — ·Red Hat
  • cpe:/a:redhat:enterprise_linux:8 Versions 8 — ·Red Hat
  • cpe:/a:redhat:enterprise_linux:9 Versions 9 — ·Red Hat

Remediation

Red Hat 9 advisories

  • RHSA-2026:79217 Released 2026-10-08 · Red Hat rating Critical
    redhat-ds:11 security, bug fix, and enhancement update
    • Red Hat Directory Server 11.5 E4S for RHEL 8 389-ds-base-1.4.3.34-9.module+el8dsrv+24847+c94540a6.src::redhat-ds:11, 389-ds-base-1.4.3.34-9.module+el8dsrv+24847+c94540a6.x86_64::redhat-ds:11, 389-ds-base-devel-1.4.3.34-9.module+el8dsrv+24847+c94540a6.x86_64::redhat-ds:11 +5
  • RHSA-2026:65375 Released 2026-09-08 · Red Hat rating Important
    redhat-ds:12 security update
    • Red Hat Directory Server 12.8 for RHEL 9 389-ds-base-2.8.0-7.module+el9dsrv+24844+8988a132.src::redhat-ds:12, cockpit-389-ds-2.8.0-7.module+el9dsrv+24844+8988a132.noarch::redhat-ds:12
  • RHSA-2026:64793 Released 2026-09-08 · Red Hat rating Critical
    redhat-ds:11 security, bug fix, and enhancement update
    • Red Hat Directory Server 11.9 for RHEL 8 389-ds-base-1.4.3.39-28.module+el8dsrv+24826+9ffa737d.src::redhat-ds:11, 389-ds-base-1.4.3.39-28.module+el8dsrv+24826+9ffa737d.x86_64::redhat-ds:11, 389-ds-base-devel-1.4.3.39-28.module+el8dsrv+24826+9ffa737d.x86_64::redhat-ds:11 +5
Show 6 more Red Hat advisories
  • RHSA-2026:64780 Released 2026-09-08 · Red Hat rating Critical
    redhat-ds:12 security, bug fix, and enhancement update
    • Red Hat Directory Server 12.4 E4S for RHEL 9 389-ds-base-2.4.5-26.module+el9dsrv+24813+95aeb06d.src::redhat-ds:12, 389-ds-base-2.4.5-26.module+el9dsrv+24813+95aeb06d.x86_64::redhat-ds:12, 389-ds-base-devel-2.4.5-26.module+el9dsrv+24813+95aeb06d.x86_64::redhat-ds:12 +4
  • RHSA-2026:64782 Released 2026-09-08 · Red Hat rating Important
    redhat-ds:12 security update
    • Red Hat Directory Server 12.6 EUS for RHEL 9 389-ds-base-2.6.1-4.module+el9dsrv+24810+65883465.src::redhat-ds:12, cockpit-389-ds-2.6.1-4.module+el9dsrv+24810+65883465.noarch::redhat-ds:12
  • RHSA-2026:64792 Released 2026-09-08 · Red Hat rating Critical
    redhat-ds:11 security, bug fix, and enhancement update
    • Red Hat Directory Server 11.7 E4S for RHEL 8 389-ds-base-1.4.3.34-18.module+el8dsrv+24812+0acb1821.src::redhat-ds:11, 389-ds-base-1.4.3.34-18.module+el8dsrv+24812+0acb1821.x86_64::redhat-ds:11, 389-ds-base-devel-1.4.3.34-18.module+el8dsrv+24812+0acb1821.x86_64::redhat-ds:11 +5
  • RHSA-2026:64779 Released 2026-09-08 · Red Hat rating Critical
    redhat-ds:12 security, bug fix, and enhancement update
    • Red Hat Directory Server 12.2 E4S for RHEL 9 389-ds-base-2.2.7-18.module+el9dsrv+24814+6d9b6eb5.src::redhat-ds:12, 389-ds-base-2.2.7-18.module+el9dsrv+24814+6d9b6eb5.x86_64::redhat-ds:12, 389-ds-base-devel-2.2.7-18.module+el9dsrv+24814+6d9b6eb5.x86_64::redhat-ds:12 +4
  • RHSA-2026:64768 Released 2026-09-08 · Red Hat rating Important
    389-ds-base security update
    • Red Hat Directory Server 13.2 for RHEL 10 389-ds-base-3.2.0-7.el10dsrv, cockpit-389-ds-3.2.0-7.el10dsrv
  • RHSA-2026:64769 Released 2026-09-08 · Red Hat rating Important
    389-ds-base security update
    • Red Hat Directory Server 13.0 EUS for RHEL 10 389-ds-base-3.0.6-4.el10dsrv, cockpit-389-ds-3.0.6-4.el10dsrv

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Red Hat Directory Server 11, Red Hat Directory Server 11.5 E4S for RHEL 8 and 9 more products — RHSA-2026:64779

    5 records Highest priority Priority MEDIUM 3 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2026-15471 Improper authentication in Red Hat Directory Server 11.5 E4S for RHEL 8Priority MEDIUM 44
    • TI-2026-53505 389-ds-base: 389-ds: anonymous ldap client can defeat selfdn aci bind-rule checks via empty bind dnPriority MEDIUM 40
    • TI-2026-15160 NULL pointer dereference in Red Hat Directory Server 11.5 E4S for RHEL 8Priority MEDIUM 40
    Show all 5 records → Advisory →
  • Advisory ·

    Red Hat Directory Server 11, Red Hat Directory Server 11.5 E4S for RHEL 8 and 9 more products — RHSA-2026:64780

    5 records Highest priority Priority MEDIUM 3 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2026-15471 Improper authentication in Red Hat Directory Server 11.5 E4S for RHEL 8Priority MEDIUM 44
    • TI-2026-53505 389-ds-base: 389-ds: anonymous ldap client can defeat selfdn aci bind-rule checks via empty bind dnPriority MEDIUM 40
    • TI-2026-15160 NULL pointer dereference in Red Hat Directory Server 11.5 E4S for RHEL 8Priority MEDIUM 40
    Show all 5 records → Advisory →
Show 2 more groups
  • Advisory ·

    Red Hat Directory Server 11, Red Hat Directory Server 11.5 E4S for RHEL 8 and 9 more products — RHSA-2026:64792

    5 records Highest priority Priority MEDIUM 3 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2026-15471 Improper authentication in Red Hat Directory Server 11.5 E4S for RHEL 8Priority MEDIUM 44
    • TI-2026-53505 389-ds-base: 389-ds: anonymous ldap client can defeat selfdn aci bind-rule checks via empty bind dnPriority MEDIUM 40
    • TI-2026-15160 NULL pointer dereference in Red Hat Directory Server 11.5 E4S for RHEL 8Priority MEDIUM 40
    Show all 5 records → Advisory →
  • Advisory ·

    Red Hat Directory Server 11, Red Hat Directory Server 11.5 E4S for RHEL 8 and 9 more products — RHSA-2026:64793

    5 records Highest priority Priority MEDIUM 3 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2026-15471 Improper authentication in Red Hat Directory Server 11.5 E4S for RHEL 8Priority MEDIUM 44
    • TI-2026-53505 389-ds-base: 389-ds: anonymous ldap client can defeat selfdn aci bind-rule checks via empty bind dnPriority MEDIUM 40
    • TI-2026-15160 NULL pointer dereference in Red Hat Directory Server 11.5 E4S for RHEL 8Priority MEDIUM 40
    Show all 5 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Directory Server 11AffectedNo fix yet
Red Hat Directory Server 12AffectedNo fix yet
Red Hat Enterprise Linux 10AffectedNo fix yet
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 8AffectedNo fix yet
Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat Directory Server 11.5 E4S for RHEL 8Fixed RHSA-2026:79217
Red Hat Directory Server 11.7 E4S for RHEL 8Fixed RHSA-2026:64792
Red Hat Directory Server 11.9 for RHEL 8Fixed RHSA-2026:64793
Red Hat Directory Server 12.2 E4S for RHEL 9Fixed RHSA-2026:64779
Red Hat Directory Server 12.4 E4S for RHEL 9Fixed RHSA-2026:64780
Red Hat Directory Server 12.6 EUS for RHEL 9Fixed RHSA-2026:64782
Red Hat Directory Server 12.8 for RHEL 9Fixed RHSA-2026:65375
Red Hat Directory Server 13.0 EUS for RHEL 10Fixed RHSA-2026:64769
Red Hat Directory Server 13.2 for RHEL 10Fixed RHSA-2026:64768
Not affected: 2 products
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-19843
  2. 2026-10-03 Alias added: GHSA-p34m-7cj2-q64p
  3. 2026-10-08 Fix available: redhat-ds:[email protected] · CNA
  4. 2026-10-08 1 new reference · CNA
  5. 2026-10-09 Fix available: RHSA-2026:79217 · Red Hat
  6. 2026-10-09 Fix available: Red Hat Directory Server 11.5 E4S for RHEL 8 · Red Hat

References

Advisory 9

Other 2

  • TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
  • TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
  • TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
  • TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
See all 7413 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences