CVE-2026-76560 PUBLISHED

389-ds-base: 389-ds: anonymous ldap client can defeat selfdn aci bind-rule checks via empty bind dn

Assigner: redhat
Reserved: 19.08.2026 Published: 07.09.2026 Updated: 08.09.2026

A flaw was found in 389 Directory Server. The SELFDN ACI bind-rule evaluator incorrectly matches an anonymous LDAP client's empty bind DN against an empty stored attribute value, allowing an unauthenticated client to satisfy access control checks intended to require a matching authenticated identity. This can allow an anonymous LDAP client to perform an operation, such as adding or modifying a directory entry, that a SELFDN-based ACI intended to restrict to a specific authenticated user.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS Score: 7.5

Product Status

Vendor Red Hat
Product Red Hat Directory Server 11.7 E4S for RHEL 8
Versions Default: affected
  • unaffected from 8080020260903102346.f969626e to * (excl.)
Vendor Red Hat
Product Red Hat Directory Server 12.2 E4S for RHEL 9
Versions Default: affected
  • unaffected from 9020020260903155914.1674d574 to * (excl.)
Vendor Red Hat
Product Red Hat Enterprise Linux 10.0 Extended Update Support
Versions Default: affected
  • unaffected from 0:3.0.6-21.el10_0 to * (excl.)
Vendor Red Hat
Product Red Hat Enterprise Linux 7 Extended Lifecycle Support
Versions Default: affected
  • unaffected from 0:1.3.11.1-15.el7_9 to * (excl.)
Vendor Red Hat
Product Red Hat Enterprise Linux 8
Versions Default: affected
  • unaffected from 8100020260904155442.25e700aa to * (excl.)
Vendor Red Hat
Product Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
Versions Default: affected
  • unaffected from 8040020260901171549.96015a92 to * (excl.)
Vendor Red Hat
Product Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On
Versions Default: affected
  • unaffected from 8040020260901171549.96015a92 to * (excl.)
Vendor Red Hat
Product Red Hat Enterprise Linux 8.8 Telecommunications Update Service
Versions Default: affected
  • unaffected from 8080020260831180218.6dbb3803 to * (excl.)
Vendor Red Hat
Product Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
Versions Default: affected
  • unaffected from 8080020260831180218.6dbb3803 to * (excl.)
Vendor Red Hat
Product Red Hat Enterprise Linux 9
Versions Default: affected
  • unaffected from 0:2.8.0-10.el9_8 to * (excl.)
Vendor Red Hat
Product Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
Versions Default: affected
  • unaffected from 0:2.2.4-22.el9_2 to * (excl.)
Vendor Red Hat
Product Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions
Versions Default: affected
  • unaffected from 0:2.4.5-29.el9_4 to * (excl.)
Vendor Red Hat
Product Red Hat Enterprise Linux 9.6 Extended Update Support
Versions Default: affected
  • unaffected from 0:2.6.1-24.el9_6 to * (excl.)
Vendor Red Hat
Product Red Hat Directory Server 11
Versions Default: affected
Vendor Red Hat
Product Red Hat Directory Server 11
Versions Default: affected
Vendor Red Hat
Product Red Hat Directory Server 12
Versions Default: affected
Vendor Red Hat
Product Red Hat Directory Server 12
Versions Default: affected
Vendor Red Hat
Product Red Hat Directory Server 13
Versions Default: unaffected
Vendor Red Hat
Product Red Hat Enterprise Linux 10
Versions Default: affected
Vendor Red Hat
Product Red Hat Enterprise Linux 6
Versions Default: unknown
Vendor Red Hat
Product Red Hat Enterprise Linux 8
Versions Default: affected

Workarounds

Until a fix is available, review all ACIs using userattr="...#SELFDN" bind rules and confirm the target attribute cannot be set to an empty value, or add an explicit authmethod restriction to the ACI to prevent anonymous binds from satisfying the check. Where anonymous binds are not required, disabling anonymous access to the directory removes the attack surface entirely.

Credits

  • Red Hat would like to thank Gia Bui (yabeow) (Calif.io) for reporting this issue.

References

Problem Types

  • Incorrect Authorization CWE