CVE-2026-11770
published 2026-07-31CVE-2026-11770: A flaw was found in 389 Directory Server. An unauthenticated remote attacker can inject LDAP search filters into the CleanAllRUV replication status-check…
PriorityP351high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
0.53%
43.8th percentile
A flaw was found in 389 Directory Server. An unauthenticated remote attacker can inject LDAP search filters into the CleanAllRUV replication status-check extended operation. Because the handler performs the search against cn=config with elevated replication plugin privileges and returns a boolean match result, the attacker can extract sensitive server configuration metadata, including replication bind DNs and password storage scheme information.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| port389 | 389-ds-base | — | — |
| redhat-ds_11 | 389-ds-base | — | — |
| redhat-ds_12 | 389-ds-base | — | — |
| redhat | directory_server | — | — |
| redhat | directory_server | — | — |
| redhat | directory_server | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
389-ds-base: 389-ds-base: pre-auth LDAP filter injection in CleanAllRUV status check
vendor_redhat·2026-07-31·CVSS 7.5
CVE-2026-11770 [HIGH] CWE-90 389-ds-base: 389-ds-base: pre-auth LDAP filter injection in CleanAllRUV status check
389-ds-base: 389-ds-base: pre-auth LDAP filter injection in CleanAllRUV status check
A flaw was found in 389 Directory Server. An unauthenticated remote attacker can inject LDAP search filters into the CleanAllRUV replication status-check extended operation. Because the handler performs the search against cn=config with elevated replication plugin privileges and returns a boolean match result, the attacker can extract sensitive server configuration metadata, including replication bind DNs and password storage scheme information.
Statement: A Moderate impact information disclosure flaw was found in 389 Directory Server. An unauthenticated remote attacker can exploit an LDAP filter injection vulnerability in the CleanAllRUV status-check extended operation. Red Hat products with `nsslapd-al
GHSA
A flaw was found in 389 Directory Server.
ghsa_unreviewed·2026-07-31
CVE-2026-11770 [HIGH] CWE-90 A flaw was found in 389 Directory Server.
A flaw was found in 389 Directory Server. An unauthenticated remote attacker can inject LDAP search filters into the CleanAllRUV replication status-check extended operation. Because the handler performs the search against cn=config with elevated replication plugin privileges and returns a boolean match result, the attacker can extract sensitive server configuration metadata, including replication bind DNs and password storage scheme information.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-11770 389-ds-base: 389-ds-base: pre-auth LDAP filter injection in CleanAllRUV status check [fedora-all]
bugzilla·2026-07-31·CVSS 7.5
CVE-2026-11770 [HIGH] CVE-2026-11770 389-ds-base: 389-ds-base: pre-auth LDAP filter injection in CleanAllRUV status check [fedora-all]
CVE-2026-11770 389-ds-base: 389-ds-base: pre-auth LDAP filter injection in CleanAllRUV status check [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
389-ds-base security assessment finding 021 (2026-04-22).
Pre-auth LDAP filter injection in CleanAllRUV status-check extop (OID 2.16.840.1.113730.3.6.8). Handler multisupplier_extop_cleanruv_check_status() in repl_extop.c passes attacker-supplied filter unsanitized to internal cn=config search with replication plugin identity. No auth checks (unlike other replication extops).
With default nsslapd-allow-anonymous-access: on, anonymous bind suffices. Boolea
Bugzilla
CVE-2026-11770 389-ds-base: 389-ds-base: pre-auth LDAP filter injection in CleanAllRUV status check
bugzilla·2026-06-04·CVSS 7.5
CVE-2026-11770 [HIGH] CVE-2026-11770 389-ds-base: 389-ds-base: pre-auth LDAP filter injection in CleanAllRUV status check
CVE-2026-11770 389-ds-base: 389-ds-base: pre-auth LDAP filter injection in CleanAllRUV status check
389-ds-base security assessment finding 021 (2026-04-22).
Pre-auth LDAP filter injection in CleanAllRUV status-check extop (OID 2.16.840.1.113730.3.6.8). Handler multisupplier_extop_cleanruv_check_status() in repl_extop.c passes attacker-supplied filter unsanitized to internal cn=config search with replication plugin identity. No auth checks (unlike other replication extops).
With default nsslapd-allow-anonymous-access: on, anonymous bind suffices. Boolean oracle extracts 31 cn=config attributes (replication bind DN, password storage scheme, paths, ACI keywords). Password hashes not extractable via substring.
PoC confirmed: RHEL 7 (389-ds-base-1.3.11.1-5.el7_9), Fedora 42 (389-ds-base-3.
https://access.redhat.com/errata/RHSA-2026:55421https://access.redhat.com/errata/RHSA-2026:55422https://access.redhat.com/errata/RHSA-2026:55423https://access.redhat.com/errata/RHSA-2026:55424https://access.redhat.com/errata/RHSA-2026:55425https://access.redhat.com/errata/RHSA-2026:55426https://access.redhat.com/errata/RHSA-2026:55530https://access.redhat.com/errata/RHSA-2026:55532https://access.redhat.com/errata/RHSA-2026:55756https://access.redhat.com/errata/RHSA-2026:55757https://access.redhat.com/errata/RHSA-2026:55758https://access.redhat.com/errata/RHSA-2026:55794https://access.redhat.com/errata/RHSA-2026:56047https://access.redhat.com/errata/RHSA-2026:56048https://access.redhat.com/errata/RHSA-2026:56050https://access.redhat.com/errata/RHSA-2026:79217https://access.redhat.com/security/cve/CVE-2026-11770https://bugzilla.redhat.com/show_bug.cgi?id=2484802https://github.com/389ds/389-ds-base/blob/main/ldap/servers/plugins/replication/repl_extop.c
2026-07-31
Published