389-ds-base: 389-ds-base: pre-auth ldap filter injection in cleanallruv status check

Summary

A flaw was found in 389 Directory Server. An unauthenticated remote attacker can inject LDAP search filters into the CleanAllRUV replication status-check extended operation. Because the handler performs the search against cn=config with elevated replication plugin privileges and returns a boolean match result, the attacker can extract sensitive server configuration metadata, including replication bind DNs and password storage scheme information.

Timeline

1. Jul 31, 2026, 9:18 AM UTCCVE published
2. Jul 31, 2026, 11:22 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: yes · Technical impact: partial

3. Oct 8, 2026, 2:15 PM UTCRecord last updated

Affected versions

• redhat-ds:11

  Version range not reported

• redhat-ds:11

  Version range not reported

• redhat-ds:11

  Version range not reported

• redhat-ds:12

  Version range not reported

• redhat-ds:12

  Version range not reported

• 389-ds-base

  Version range not reported

• 389-ds-base

  Version range not reported

• 389-ds-base

  Version range not reported

• 389-ds:1.4

  Version range not reported

• 389-ds:1.4

  Version range not reported

• 389-ds:1.4

  Version range not reported

• 389-ds:1.4

  Version range not reported

• 389-ds:1.4

  Version range not reported

• 389-ds:1.4

  Version range not reported

• 389-ds:1.4

  Version range not reported

• 389-ds-base

  Version range not reported

• 389-ds-base

  Version range not reported

• 389-ds-base

  Version range not reported

• 389-ds-base

  Version range not reported

• redhat-ds:12/389-ds-base

  Version range not reported

• 389-ds-base

  Version range not reported

• 389-ds-base

  Version range not reported

References 19