CVE-2026-19843 PUBLISHED

389-ds-base: 389-ds-base: command injection via unescaped ldap dn in cockpit 389 console ldap editor

Assigner: redhat
Reserved: 14.08.2026 Published: 07.09.2026 Updated: 08.09.2026

A flaw was found in 389-ds-base. The Cockpit 389 Console's LDAP editor constructs an ldapsearch command by embedding an LDAP entry's distinguished name (DN) into a shell command string without proper escaping. An LDAP user with delegated privileges to create or rename directory entries could craft a malicious DN containing shell metacharacters. When a Cockpit administrator subsequently views the entry in the 389 Console, the embedded shell command executes with root privileges on the directory server host.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
CVSS Score: 8.4

Product Status

Vendor Red Hat
Product Red Hat Directory Server 11.7 E4S for RHEL 8
Versions Default: affected
  • unaffected from 8080020260903102346.f969626e to * (excl.)
Vendor Red Hat
Product Red Hat Directory Server 12.2 E4S for RHEL 9
Versions Default: affected
  • unaffected from 9020020260903155914.1674d574 to * (excl.)
Vendor Red Hat
Product Red Hat Directory Server 12.6 EUS for RHEL 9
Versions Default: affected
  • unaffected from 9060020260903100230.1674d574 to * (excl.)
Vendor Red Hat
Product Red Hat Directory Server 13.0 EUS for RHEL 10
Versions Default: affected
  • unaffected from 0:3.0.6-4.el10dsrv to * (excl.)
Vendor Red Hat
Product Red Hat Directory Server 13.2 for RHEL 10
Versions Default: affected
  • unaffected from 0:3.2.0-7.el10dsrv to * (excl.)
Vendor Red Hat
Product Red Hat Directory Server 11
Versions Default: affected
Vendor Red Hat
Product Red Hat Directory Server 11
Versions Default: affected
Vendor Red Hat
Product Red Hat Directory Server 12
Versions Default: affected
Vendor Red Hat
Product Red Hat Directory Server 12
Versions Default: affected
Vendor Red Hat
Product Red Hat Enterprise Linux 10
Versions Default: affected
Vendor Red Hat
Product Red Hat Enterprise Linux 6
Versions Default: unknown
Vendor Red Hat
Product Red Hat Enterprise Linux 7
Versions Default: unaffected
Vendor Red Hat
Product Red Hat Enterprise Linux 8
Versions Default: affected
Vendor Red Hat
Product Red Hat Enterprise Linux 8
Versions Default: unaffected
Vendor Red Hat
Product Red Hat Enterprise Linux 9
Versions Default: affected

Workarounds

Restrict Cockpit 389 Console access to trusted administrators, and restrict delegated LDAP add/rename privileges to trusted accounts, until a fix is available. This issue only affects Red Hat Directory Server deployments that include the Cockpit console; plain RHEL 389-ds-base is not affected.

Credits

  • Red Hat would like to thank Andrew Rukin (Arenadata) for reporting this issue.

References

Problem Types

  • Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CWE