RHSA-2026:64811CriticalCVSS 9.8

Red Hat Security Advisory: 389-ds-base security update

Published
September 8, 2026
Last Modified
September 25, 2026

🔗 CVE IDs covered (1)

CVE-2026-18922 →

📋 Description

CVE-2026-18922 — 389-ds-base: 389-ds-base: SASL PLAIN authentication allows privilege escalation to Directory Manager via stale identity in Cyrus SASL auxiliary property

🎯 Affected products13

  • Red Hat Enterprise Linux Server -EXTENSION(v. 6 ELS-EXTENSION)
  • Red Hat Enterprise Linux Server Optional -EXTENSION (v. 6 ELS -EXTENSION)
  • 389-ds-base-0:1.2.11.15-97.el6_10.1.i686 as a component of Red Hat Enterprise Linux Server -EXTENSION(v. 6 ELS-EXTENSION)
  • 389-ds-base-0:1.2.11.15-97.el6_10.1.src as a component of Red Hat Enterprise Linux Server -EXTENSION(v. 6 ELS-EXTENSION)
  • 389-ds-base-0:1.2.11.15-97.el6_10.1.x86_64 as a component of Red Hat Enterprise Linux Server -EXTENSION(v. 6 ELS-EXTENSION)
  • 389-ds-base-debuginfo-0:1.2.11.15-97.el6_10.1.i686 as a component of Red Hat Enterprise Linux Server -EXTENSION(v. 6 ELS-EXTENSION)
  • 389-ds-base-debuginfo-0:1.2.11.15-97.el6_10.1.i686 as a component of Red Hat Enterprise Linux Server Optional -EXTENSION (v. 6 ELS -EXTENSION)
  • 389-ds-base-debuginfo-0:1.2.11.15-97.el6_10.1.x86_64 as a component of Red Hat Enterprise Linux Server -EXTENSION(v. 6 ELS-EXTENSION)
  • 389-ds-base-debuginfo-0:1.2.11.15-97.el6_10.1.x86_64 as a component of Red Hat Enterprise Linux Server Optional -EXTENSION (v. 6 ELS -EXTENSION)
  • 389-ds-base-devel-0:1.2.11.15-97.el6_10.1.i686 as a component of Red Hat Enterprise Linux Server Optional -EXTENSION (v. 6 ELS -EXTENSION)
  • 389-ds-base-devel-0:1.2.11.15-97.el6_10.1.x86_64 as a component of Red Hat Enterprise Linux Server Optional -EXTENSION (v. 6 ELS -EXTENSION)
  • 389-ds-base-libs-0:1.2.11.15-97.el6_10.1.i686 as a component of Red Hat Enterprise Linux Server -EXTENSION(v. 6 ELS-EXTENSION)
  • 389-ds-base-libs-0:1.2.11.15-97.el6_10.1.x86_64 as a component of Red Hat Enterprise Linux Server -EXTENSION(v. 6 ELS-EXTENSION)

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Administrators can restrict nsslapd-allowed-sasl-mechanisms to only the mechanisms actually required (e.g. GSSAPI, EXTERNAL, GSS-SPNEGO), excluding PLAIN. Since the exploit chain requires the first bind attempt to be a failed SASL PLAIN bind as cn=Directory Manager, removing PLAIN from the allowed mechanism list prevents that step entirely — this blocks both the originally reported variant (valid low-privileged account) and the zero-credential SASL ANONYMOUS variant, since both depend on the same initial PLAIN bind to plant the stale identity.

🔗 References (4)