CVE-2026-86345: 389-ds-base StartTLS Plaintext Buffer Retention Allows LDAP Authentication Forging

Vulnerability Overview Vulnerability ID: Bug 2529332 (CVE-2026-86345) Vulnerability Name: 389-ds-base: StartTLS plaintext-buffer retention allows on-path attacker to forge an LDAP client's authentication result Report Date: 2026-09-07 09:22 UTC by OSDB Bzreport Modification Date: 2026-10-01 22:23 UTC Status: NEW Product: Security Response Component: vulnerability Version: unspecified Hardware: All OS: Linux Priority: medium Severity: medium Target Milestone: --- Assigned To: Product Security DevOps Team QA Contact: --- Docs Contact: --- URL: --- Whiteboard: --- Depends on: 2544691 Blocks: --- TreeView: Depends on 0 blocked Scope of Impact Affected Versions: 389-ds-base-2.6.1-6.el9 Impact Description: When a client negotiates StartTLS, the server ( in ) replaces the connection's underlying socket with a TLS-wrapped socket but does not drop or invalidate the plaintext bytes already buffered in the connection ( / ). These bytes are typically reset upon BER parsing errors or during read flushes but are not reset during the StartTLS transport switch. An attacker can inject a second LDAP message into the same TCP connection. After the server switches to TLS, the attacker can retrieve this message from the stale plaintext buffer via the connection service in . By replacing the client's next operation (its Bind) with this injected message, the attacker's forged (e.g., an anonymous bind, which always succeeds) is passed to the client, replacing the real bind response. The connection's single-operation guard in transaction mode fails to detect this because the forged bytes have not yet been tracked as part of an operation. This results in the client believing the authentication attempt was successful, while the directory actually rejected it. The default configuration is affected ( defaults to 8); no misconfiguration is required. Independent reproduction was performed against a genuine, shipped build of 389-ds-base-2.6.1-6.el9: an incorrect password LDAP bind was forged to report success, and using a custom PAM test suite, a full PAM login session was opened for an existing account within the real / / lifecycle against a genuine , using the final incorrect password. There is no privilege escalation or data leakage on the server side itself—the attacker's forged operation runs as anonymous and remains anonymous immediately after the subsequent (failed) bind resets the connection. The impact is entirely within client-side applications that trust LDAP bind results (e.g., PAM/nss-pam-ldapd). Affected applications do not require any specific parsing errors; whether it is a forged (for any LDAP client) or a related but separately reported OpenLDAP client issue where a forged is used, the attack is feasible. StartTLS on port 389 is affected; LDAPS:// (636) has no cleartext prefix and is not affected. Remediation Fix Status: No specific fix is mentioned, but the vulnerability has been reported and assigned to the Product Security DevOps Team for handling. Recommended Actions: Users are advised to update to the latest version as soon as possible to fix this vulnerability. Additionally, it is recommended to review and configure related applications to ensure they are not susceptible to this vulnerability. POC Code or Exploit Code No POC Code: No specific POC code or exploit code is provided on the page. --- The above is a summary of key vulnerability information extracted from the webpage screenshot.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-86345: 389-ds-base StartTLS Plaintext Buffer Retention Allows LDAP Authentication Forging

More from this source