CVE-2026-19843

Summary

A flaw was found in 389-ds-base. The Cockpit 389 Console's LDAP editor constructs an ldapsearch command by embedding an LDAP entry's distinguished name (DN) into a shell command string without proper escaping. An LDAP user with delegated privileges to create or rename directory entries could craft a malicious DN containing shell metacharacters. When a Cockpit administrator subsequently views the entry in the 389 Console, the embedded shell command executes with root privileges on the directory server host.

Affected Software

VendorProductVersion RangeStatus
Red HatRed Hat Directory Server 11.7 E4S for RHEL 88080020260903102346.f969626e < *unaffected
Red HatRed Hat Directory Server 11.9 for RHEL 88100020260904171440.37ed7c03 < *unaffected
Red HatRed Hat Directory Server 12.2 E4S for RHEL 99020020260903155914.1674d574 < *unaffected
Red HatRed Hat Directory Server 12.4 E4S for RHEL 99040020260903102623.1674d574 < *unaffected
Red HatRed Hat Directory Server 12.6 EUS for RHEL 99060020260903100230.1674d574 < *unaffected
Red HatRed Hat Directory Server 12.8 for RHEL 99080020260908092641.1674d574 < *unaffected
Red HatRed Hat Directory Server 13.0 EUS for RHEL 100:3.0.6-4.el10dsrv < *unaffected
Red HatRed Hat Directory Server 13.2 for RHEL 100:3.2.0-7.el10dsrv < *unaffected

Weaknesses

  • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Workarounds

Restrict Cockpit 389 Console access to trusted administrators, and restrict delegated LDAP add/rename privileges to trusted accounts, until a fix is available. This issue only affects Red Hat Directory Server deployments that include the Cockpit console; plain RHEL 389-ds-base is not affected.

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: total

References