CVE-2026-11785

Summary

A flaw was found in 389 Directory Server. A type confusion in the SSO token extended operation handler causes partial stack address information to be disclosed in LDAP responses to authenticated users.

Affected Software

Weaknesses

• CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')

Workarounds

Option 1 (Recommended): Disable the SSO token feature entirely: dsconf <instance> config replace nsslapd-enable-ldapssotoken=off. This prevents the vulnerable code path from being reached but disables SSO token functionality for all users. Option 2: Restrict network access to LDAP ports (389/636) to trusted networks via firewall rules. Note: Removing the SSO token secret from configuration does not mitigate the vulnerability — the server auto-generates a new secret at startup.

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: partial

References

• https://access.redhat.com/security/cve/CVE-2026-11785
• https://bugzilla.redhat.com/show_bug.cgi?id=2485427

• ←Previous
• Next→