CVE-2026-11770: 389-ds-base: 389-ds-base: pre-auth ldap filter injection in cleanallruv status check
389-ds-base security assessment finding 021 (2026-04-22).
Pre-auth LDAP filter injection in CleanAllRUV status-check extop (OID 2.16.840.1.113730.3.6.8). Handler multisupplierextopcleanruvcheckstatus() in replextop.c passes attacker-supplied filter unsanitized to internal cn=config search with replication plugin identity. No auth checks (unlike other replication extops).
With default nsslapd-allow-anonymous-access: on, anonymous bind suffices. Boolean oracle extracts 31 cn=config attributes (replication bind DN, password storage scheme, paths, ACI keywords). Password hashes not extractable via substring.
PoC confirmed: RHEL 7 (389-ds-base-1.3.11.1-5.el79), Fedora 42 (389-ds-base-3.1.4-6.fc42).
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5). Red Hat impact: Moderate. CWE-90, CWE-306, CWE-20.
Other sources
A flaw was found in 389 Directory Server. An unauthenticated remote attacker can inject LDAP search filters into the CleanAllRUV replication status-check extended operation. Because the handler performs the search against cn=config with elevated replication plugin privileges and returns a boolean match result, the attacker can extract sensitive server configuration metadata, including replication bind DNs and password storage scheme information.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
389-ds-baseto a version that resolves this vulnerability.Fixed in 1.3.11.1-5.el7_9 - Upgrade
Upgrade
389-ds-baseto a version that resolves this vulnerability.Fixed in 3.1.4-6.fc42 - Configuration
Set nsslapd-allow-anonymous-access to off so anonymous bind is not permitted for the CleanAllRUV replication status-check extended operation.
389 Directory Server (389-ds-base) nsslapd-allow-anonymous-access = off
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11770?
CVE-2026-11770 has a severity rating of high, with a score of 7.5.
What type of vulnerability is CVE-2026-11770?
CVE-2026-11770 is a pre-auth LDAP filter injection vulnerability.
What component is affected by CVE-2026-11770?
CVE-2026-11770 affects the 389-ds-base component of the 389 Directory Server.
How do I fix CVE-2026-11770?
To fix CVE-2026-11770, update to the latest version of the 389 Directory Server that addresses this vulnerability.
What impact could CVE-2026-11770 have on my system?
CVE-2026-11770 could allow an attacker to inject malicious LDAP filters, potentially compromising sensitive data.