CVE-2026-11770

Summary

A flaw was found in 389 Directory Server. An unauthenticated remote attacker can inject LDAP search filters into the CleanAllRUV replication status-check extended operation. Because the handler performs the search against cn=config with elevated replication plugin privileges and returns a boolean match result, the attacker can extract sensitive server configuration metadata, including replication bind DNs and password storage scheme information.

Affected Software

VendorProductVersion RangeStatus

Weaknesses

  • CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')

Workarounds

Set nsslapd-allow-anonymous-access to rootdse or off. Restrict LDAP ports to trusted networks. Monitor for extop OID 2.16.840.1.113730.3.6.8. Use strong replication manager passwords.

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: yes
    • Technical Impact: partial

References