Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-19843— 389-ds-base: 389-ds-base: command injection via unescaped ldap dn in cockpit 389 console ldap editor

Quick assessment

Affected

Red Hat Red Hat Directory Server 11.5 E4S for RHEL 8

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

389 Directory Server是389 Directory Server团队开源的一款目录服务器软件。 389 Directory Server存在命令注入漏洞，该漏洞源于Cockpit 389 Console的LDAP编辑器在构造ldapsearch命令时未正确转义LDAP条目的DN，可能允许具有委派权限的LDAP用户通过特制DN注入shell命令，导致以root权限执行任意命令。

CVSS 8.4 · High EPSS 0.48% · P40 Updated Oct 08, 2026

Possible ATT&CK Techniques 2 AI

T1068.003 T1059 · Command and Scripting Interpreter

Affected Version Matrix 17

Vendor	Product	Version Range	Status
Red Hat	Red Hat Directory Server 11	`any`	affected
Red Hat	Red Hat Directory Server 11.5 E4S for RHEL 8	`8060020260908152739.0ca98e7e< *`	unaffected
Red Hat	Red Hat Directory Server 11.7 E4S for RHEL 8	`8080020260903102346.f969626e< *`	unaffected
Red Hat	Red Hat Directory Server 11.9 for RHEL 8	`8100020260904171440.37ed7c03< *`	unaffected
Red Hat	Red Hat Directory Server 12	`any`	affected
Red Hat	Red Hat Directory Server 12.2 E4S for RHEL 9	`9020020260903155914.1674d574< *`	unaffected
Red Hat	Red Hat Directory Server 12.4 E4S for RHEL 9	`9040020260903102623.1674d574< *`	unaffected
Red Hat	Red Hat Directory Server 12.6 EUS for RHEL 9	`9060020260903100230.1674d574< *`	unaffected
Red Hat	Red Hat Directory Server 12.8 for RHEL 9	`9080020260908092641.1674d574< *`	unaffected
Red Hat	Red Hat Directory Server 13.0 EUS for RHEL 10	`0:3.0.6-4.el10dsrv< *`	unaffected
Red Hat	Red Hat Directory Server 13.2 for RHEL 10	`0:3.2.0-7.el10dsrv< *`	unaffected
Red Hat	Red Hat Enterprise Linux 10	`any`	affected
Red Hat	Red Hat Enterprise Linux 6	`any`	unknown
Red Hat	Red Hat Enterprise Linux 7	`any`	unaffected
Red Hat	Red Hat Enterprise Linux 8	`any`	affected
		`any`	unaffected
Red Hat	Red Hat Enterprise Linux 9	`any`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-19843

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

389-ds-base: 389-ds-base: command injection via unescaped ldap dn in cockpit 389 console ldap editor

Source: CVE Program / CVE List V5

Vulnerability Description

A flaw was found in 389-ds-base. The Cockpit 389 Console's LDAP editor constructs an ldapsearch command by embedding an LDAP entry's distinguished name (DN) into a shell command string without proper escaping. An LDAP user with delegated privileges to create or rename directory entries could craft a malicious DN containing shell metacharacters. When a Cockpit administrator subsequently views the entry in the 389 Console, the embedded shell command executes with root privileges on the directory server host.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

OS命令中使用的特殊元素转义处理不恰当(OS命令注入)

Source: CVE Program / CVE List V5

Vulnerability Title

389 Directory Server 命令注入漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE
Red Hat	Red Hat Directory Server 11.5 E4S for RHEL 8	8060020260908152739.0ca98e7e ~ *	`cpe:/a:redhat:directory_server_e4s:11.5::el8`
Red Hat	Red Hat Directory Server 11.7 E4S for RHEL 8	8080020260903102346.f969626e ~ *	`cpe:/a:redhat:directory_server_e4s:11.7::el8`
Red Hat	Red Hat Directory Server 11.9 for RHEL 8	8100020260904171440.37ed7c03 ~ *	`cpe:/a:redhat:directory_server:11.9::el8`
Red Hat	Red Hat Directory Server 12.2 E4S for RHEL 9	9020020260903155914.1674d574 ~ *	`cpe:/a:redhat:directory_server_e4s:12.2::el9`
Red Hat	Red Hat Directory Server 12.4 E4S for RHEL 9	9040020260903102623.1674d574 ~ *	`cpe:/a:redhat:directory_server_e4s:12.4::el9`
Red Hat	Red Hat Directory Server 12.6 EUS for RHEL 9	9060020260903100230.1674d574 ~ *	`cpe:/a:redhat:directory_server_eus:12.6::el9`
Red Hat	Red Hat Directory Server 12.8 for RHEL 9	9080020260908092641.1674d574 ~ *	`cpe:/a:redhat:directory_server:12.8::el9`
Red Hat	Red Hat Directory Server 13.0 EUS for RHEL 10	0:3.0.6-4.el10dsrv ~ *	`cpe:/a:redhat:directory_server_e2s:13.0::el10`
Red Hat	Red Hat Directory Server 13.2 for RHEL 10	0:3.2.0-7.el10dsrv ~ *	`cpe:/a:redhat:directory_server:13.2::el10`
Red Hat	Red Hat Directory Server 11	-	`cpe:/a:redhat:directory_server:11`
Red Hat	Red Hat Directory Server 12	-	`cpe:/a:redhat:directory_server:12`
Red Hat	Red Hat Enterprise Linux 10	-	`cpe:/o:redhat:enterprise_linux:10`
Red Hat	Red Hat Enterprise Linux 6	-	`cpe:/o:redhat:enterprise_linux:6`
Red Hat	Red Hat Enterprise Linux 7	-	`cpe:/o:redhat:enterprise_linux:7`
Red Hat	Red Hat Enterprise Linux 8	-	`cpe:/o:redhat:enterprise_linux:8`
Red Hat	Red Hat Enterprise Linux 8	-	`cpe:/o:redhat:enterprise_linux:8`
Red Hat	Red Hat Enterprise Linux 9	-	`cpe:/o:redhat:enterprise_linux:9`

II. Public POCs for CVE-2026-19843

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-19843

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-19843 (8)

🔗 CVE-2026-19843 - Red Hat Customer Portal vdb-entry x_refsource_REDHAT
🔗 2515965 – (CVE-2026-19843) CVE-2026-19843 389-ds-base: 389-ds-base: Command injection via unescaped LDAP DN in Cockpit 389 Console LDAP editor Read full article issue-tracking x_refsource_REDHAT
🔗 RHSA-2026:65375 - Security Advisory - Red Hat Customer Portal vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:64780 - Security Advisory - Red Hat Customer Portal vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:64782 - Security Advisory - Red Hat Customer Portal vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:64793 - Security Advisory - Red Hat Customer Portal vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:64769 - Security Advisory - Red Hat Customer Portal vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:79217 - Security Advisory - Red Hat Customer Portal vendor-advisory x_refsource_REDHAT

Other References for CVE-2026-19843 (3)

https://access.redhat.com/errata/RHSA-2026:64792 vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:64779 vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:64768 vendor-advisory x_refsource_REDHAT

https://www.cve.org/CVERecord?id=CVE-2026-19843

Same Patch Batch · Red Hat · 2026-09-07 · 10 CVEs total

CVE-2026-18922	9.8 CRITICAL	389-ds-base: 389-ds-base: sasl plain authentication allows privilege escalation to directo
CVE-2026-76578	9.8 CRITICAL	Ipa: freeipa: freeipa: unauthenticated ldap client can obtain administrator credentials vi
CVE-2026-86404	8.8 HIGH	Artemis-server: artemis-jms-client: artemis-core-client: undertow-core: wildfly-messaging-
CVE-2026-79678	8.1 HIGH	Freeipa: idm: freeipa: idp-add eval() reachable before authorization check allows environm
CVE-2026-18453	7.5 HIGH	389-ds-base: 389-ds-base: pre-authentication null pointer dereference via paged results an
CVE-2026-18355	7.5 HIGH	389-ds-base: 389-ds-base: heap buffer overflow via sasl wrapped-record length lower-bound
CVE-2026-76560	7.5 HIGH	389-ds-base: 389-ds: anonymous ldap client can defeat selfdn aci bind-rule checks via empt
CVE-2026-86332	6.5 MEDIUM	Odh-dashboard: odh-dashboard: nim credential secret readable by any authenticated user
CVE-2026-86469	5.3 MEDIUM	Glib2: toctou symlink race in `g_file_create_replace_destination` fallback path

IV. Related Vulnerabilities

Same product: Red Hat Directory Server 11.5 E4S for RHEL 8

Same vendor: Red Hat

Same weakness: CWE-78

V. Comments for CVE-2026-19843

No comments yet

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-19843— 389-ds-base: 389-ds-base: command injection via unescaped ldap dn in cockpit 389 console ldap editor

Quick assessment

Possible ATT&CK Techniques 2 AI

Affected Version Matrix 17

I. Basic Information for CVE-2026-19843

Vulnerability Information

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Affected Products

II. Public POCs for CVE-2026-19843

III. Intelligence Information for CVE-2026-19843

Vendor Advisories for CVE-2026-19843 (8)

Other References for CVE-2026-19843 (3)

Same Patch Batch · Red Hat · 2026-09-07 · 10 CVEs total

IV. Related Vulnerabilities

V. Comments for CVE-2026-19843

Leave a comment