Attestkeep
Language: English
Sign up

Vulnerabilities / CVE-2026-18922

critical

CVE-2026-18922

389-ds-base: 389-ds-base: SASL PLAIN authentication allows privilege escalation to Directory Manager via stale identity in Cyrus SASL auxiliary property

Published Modified CWE 287
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.

Severity by source

Red Hat9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Trivy's own label is CRITICAL. Rated critical by Red Hat, AlmaLinux, Amazon, Oracle, Rocky Linux.

Description

A flaw was found in 389 Directory Server. During SASL PLAIN authentication, a stale identity carried in a Cyrus SASL auxiliary property from a prior failed bind attempt can be installed on a connection following a subsequent, unrelated successful bind, regardless of which SASL mechanism completes that second bind. An attacker can send a SASL PLAIN bind as cn=Directory Manager with an incorrect password, then complete a SASL ANONYMOUS bind on the same connection, causing the server to grant Directory Manager authority without any valid credentials. A variant using a valid low-privileged account's own successful bind instead of an anonymous one is also possible.

Affected packages and fixed versions

SourcePackageFixed in
alma 10389-ds-base, 389-ds-base-bdb, 389-ds-base-devel and 3 more3.2.0-10.el10_2
alma 8389-ds:1.4::389-ds-base, 389-ds:1.4::389-ds-base-devel, 389-ds:1.4::389-ds-base-legacy-tools and 3 more1.4.3.39-28.module_el8.10.0+4274+00f9a3f1
alma 9389-ds-base, 389-ds-base-devel, 389-ds-base-libs and 2 more2.8.0-10.el9_8
amazon linux 2389-ds-base, 389-ds-base-debuginfo, 389-ds-base-devel and 2 more1.3.10.2-17.amzn2.0.9
Oracle Linux 7389-ds-base, 389-ds-base-devel, 389-ds-base-libs and 1 more1.3.11.1-5.0.15.el7_9
Oracle Linux 8389-ds-base, 389-ds-base-devel, 389-ds-base-legacy-tools and 3 more1.4.3.39-28.module+el8.10.0+91024+7bf29691
Oracle Linux 9389-ds-base, 389-ds-base-devel, 389-ds-base-libs and 2 more2.8.0-10.el9_8
rocky 10389-ds-base, 389-ds-base-libs, 389-ds-base-snmp and 1 more3.2.0-10.el10_2
rocky 8389-ds:1.4::389-ds-base, 389-ds:1.4::389-ds-base-devel, 389-ds:1.4::389-ds-base-legacy-tools and 3 more1.4.3.39-28.module+el8.10.0+40311+cd962df1
rocky 9389-ds-base, 389-ds-base-libs, 389-ds-base-snmp and 1 more2.8.0-10.el9_8
debian 11389-ds-baseno fix listed
debian 12389-ds-baseno fix listed
Show all 78 entries from 21 sources
SourcePackageFixed in
alma 10389-ds-base3.2.0-10.el10_2
alma 10389-ds-base-bdb3.2.0-10.el10_2
alma 10389-ds-base-devel3.2.0-10.el10_2
alma 10389-ds-base-libs3.2.0-10.el10_2
alma 10389-ds-base-snmp3.2.0-10.el10_2
alma 10python3-lib3893.2.0-10.el10_2
alma 8389-ds:1.4::389-ds-base1.4.3.39-28.module_el8.10.0+4274+00f9a3f1
alma 8389-ds:1.4::389-ds-base-devel1.4.3.39-28.module_el8.10.0+4274+00f9a3f1
alma 8389-ds:1.4::389-ds-base-legacy-tools1.4.3.39-28.module_el8.10.0+4274+00f9a3f1
alma 8389-ds:1.4::389-ds-base-libs1.4.3.39-28.module_el8.10.0+4274+00f9a3f1
alma 8389-ds:1.4::389-ds-base-snmp1.4.3.39-28.module_el8.10.0+4274+00f9a3f1
alma 8389-ds:1.4::python3-lib3891.4.3.39-28.module_el8.10.0+4274+00f9a3f1
alma 9389-ds-base2.8.0-10.el9_8
alma 9389-ds-base-devel2.8.0-10.el9_8
alma 9389-ds-base-libs2.8.0-10.el9_8
alma 9389-ds-base-snmp2.8.0-10.el9_8
alma 9python3-lib3892.8.0-10.el9_8
amazon linux 2389-ds-base1.3.10.2-17.amzn2.0.9
amazon linux 2389-ds-base-debuginfo1.3.10.2-17.amzn2.0.9
amazon linux 2389-ds-base-devel1.3.10.2-17.amzn2.0.9
amazon linux 2389-ds-base-libs1.3.10.2-17.amzn2.0.9
amazon linux 2389-ds-base-snmp1.3.10.2-17.amzn2.0.9
Oracle Linux 7389-ds-base1.3.11.1-5.0.15.el7_9
Oracle Linux 7389-ds-base-devel1.3.11.1-5.0.15.el7_9
Oracle Linux 7389-ds-base-libs1.3.11.1-5.0.15.el7_9
Oracle Linux 7389-ds-base-snmp1.3.11.1-5.0.15.el7_9
Oracle Linux 8389-ds-base1.4.3.39-28.module+el8.10.0+91024+7bf29691
Oracle Linux 8389-ds-base-devel1.4.3.39-28.module+el8.10.0+91024+7bf29691
Oracle Linux 8389-ds-base-legacy-tools1.4.3.39-28.module+el8.10.0+91024+7bf29691
Oracle Linux 8389-ds-base-libs1.4.3.39-28.module+el8.10.0+91024+7bf29691
Oracle Linux 8389-ds-base-snmp1.4.3.39-28.module+el8.10.0+91024+7bf29691
Oracle Linux 8python3-lib3891.4.3.39-28.module+el8.10.0+91024+7bf29691
Oracle Linux 9389-ds-base2.8.0-10.el9_8
Oracle Linux 9389-ds-base-devel2.8.0-10.el9_8
Oracle Linux 9389-ds-base-libs2.8.0-10.el9_8
Oracle Linux 9389-ds-base-snmp2.8.0-10.el9_8
Oracle Linux 9python3-lib3892.8.0-10.el9_8
rocky 10389-ds-base3.2.0-10.el10_2
rocky 10389-ds-base-libs3.2.0-10.el10_2
rocky 10389-ds-base-snmp3.2.0-10.el10_2
rocky 10python3-lib3893.2.0-10.el10_2
rocky 8389-ds:1.4::389-ds-base1.4.3.39-28.module+el8.10.0+40311+cd962df1
rocky 8389-ds:1.4::389-ds-base-devel1.4.3.39-28.module+el8.10.0+40311+cd962df1
rocky 8389-ds:1.4::389-ds-base-legacy-tools1.4.3.39-28.module+el8.10.0+40311+cd962df1
rocky 8389-ds:1.4::389-ds-base-libs1.4.3.39-28.module+el8.10.0+40311+cd962df1
rocky 8389-ds:1.4::389-ds-base-snmp1.4.3.39-28.module+el8.10.0+40311+cd962df1
rocky 8389-ds:1.4::python3-lib3891.4.3.39-28.module+el8.10.0+40311+cd962df1
rocky 9389-ds-base2.8.0-10.el9_8
rocky 9389-ds-base-libs2.8.0-10.el9_8
rocky 9389-ds-base-snmp2.8.0-10.el9_8
rocky 9python3-lib3892.8.0-10.el9_8
debian 11389-ds-baseno fix listed
debian 12389-ds-baseno fix listed
debian 13389-ds-baseno fix listed
echo389-ds-baseno fix listed
rapidfort alma 10389-ds-base3.2.0-10.el10_2
rapidfort alma 10389-ds-base-bdb3.2.0-10.el10_2
rapidfort alma 10389-ds-base-devel3.2.0-10.el10_2
rapidfort alma 10389-ds-base-libs3.2.0-10.el10_2
rapidfort alma 10389-ds-base-snmp3.2.0-10.el10_2
rapidfort alma 10python3-lib3893.2.0-10.el10_2
rapidfort alma 9389-ds-base2.8.0-10.el9_8
rapidfort alma 9389-ds-base-libs2.8.0-10.el9_8
rapidfort alma 9389-ds-base-snmp2.8.0-10.el9_8
rapidfort alma 9python3-lib3892.8.0-10.el9_8
rapidfort debian 12389-ds-baseno fix listed
rapidfort debian 13389-ds-baseno fix listed
rapidfort Oracle Linux 10389-ds-base0:3.2.0-10.el10_2
rapidfort Oracle Linux 10389-ds-base-libs0:3.2.0-10.el10_2
rapidfort Oracle Linux 10389-ds-base-snmp0:3.2.0-10.el10_2
rapidfort Oracle Linux 10python3-lib3890:3.2.0-10.el10_2
rapidfort Oracle Linux 9389-ds-base0:2.8.0-10.el9_8
rapidfort Oracle Linux 9389-ds-base-libs0:2.8.0-10.el9_8
rapidfort Oracle Linux 9389-ds-base-snmp0:2.8.0-10.el9_8
rapidfort Oracle Linux 9python3-lib3890:2.8.0-10.el9_8
rapidfort rocky 9389-ds-base0:2.8.0-10.el9_8
rapidfort rocky 9389-ds-base-libs0:2.8.0-10.el9_8
rapidfort rocky 9389-ds-base-snmp0:2.8.0-10.el9_8

References

All 40 references

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.