CVE-2026-18922: 389 Directory Server Auth Bypass Vulnerability

CVE-2026-18922 Overview

A flaw was found in 389 Directory Server (389-ds-base) affecting Simple Authentication and Security Layer (SASL) bind handling. During SASL PLAIN authentication, a stale identity carried in a Cyrus SASL auxiliary property from a prior failed bind can persist on the connection. When a subsequent successful bind completes using any SASL mechanism, the server installs the stale identity, granting authority the client never proved. An attacker can send a SASL PLAIN bind as cn=Directory Manager with an incorrect password, then complete a SASL ANONYMOUS bind on the same connection to obtain Directory Manager privileges. The issue is categorized as improper authentication [CWE-287].

Critical Impact
Unauthenticated network attackers can bypass authentication and gain full Directory Manager privileges over LDAP, compromising the confidentiality, integrity, and availability of directory data.

Affected Products

Red Hat Enterprise Linux distributions shipping 389-ds-base
Red Hat Directory Server
Upstream 389 Directory Server builds using Cyrus SASL PLAIN handling

Discovery Timeline

2026-09-07 - CVE-2026-18922 published to the National Vulnerability Database
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-18922

Vulnerability Analysis

The vulnerability resides in how 389 Directory Server interacts with Cyrus SASL auxiliary properties (auxprop) across bind operations on the same LDAP connection. When a client attempts a SASL PLAIN bind, the requested authentication identity is written into the Cyrus SASL context. If that bind fails, the identity is not cleared from the auxiliary property store. A subsequent successful bind on the same connection, using any SASL mechanism, causes the server to read the leftover identity and install it as the connection's authenticated principal. The result is an authentication decision based on the earlier, unverified identity rather than the credentials just validated.

Root Cause

The root cause is improper session state management between successive SASL bind attempts. The server does not reset or invalidate the Cyrus SASL auxprop context after a failed PLAIN bind. This violates the LDAP protocol assumption that each successful bind establishes an authorization identity derived exclusively from the credentials of that bind.

Attack Vector

The attack requires only network access to the LDAP service and no prior credentials. An attacker opens an LDAP connection and issues a SASL PLAIN bind requesting cn=Directory Manager with an arbitrary incorrect password. The server rejects the bind but leaves the Directory Manager identity in the SASL auxiliary properties. The attacker then issues a SASL ANONYMOUS bind on the same connection. The anonymous bind succeeds, but the server installs the stale Directory Manager identity, granting the connection full administrative authority. A variant works by chaining the failed PLAIN bind with a valid low-privileged account's own successful bind, elevating that account to Directory Manager.

Detection Methods for CVE-2026-18922

Indicators of Compromise

LDAP access logs showing a failed SASL PLAIN bind targeting cn=Directory Manager immediately followed by a SASL ANONYMOUS bind on the same connection identifier.
Successful bind entries where the resolved authorization identity does not match the mechanism just used (for example, anonymous bind resulting in Directory Manager operations).
Directory modifications performed by connections that never completed an authenticated PLAIN or EXTERNAL bind.

Detection Strategies

Parse access logs from /var/log/dirsrv/slapd-<instance>/ and correlate BIND result codes per connection ID, alerting when a failed privileged bind is followed by any successful bind on the same connection.
Baseline the expected authentication mechanism for administrative accounts and flag any operation attributed to cn=Directory Manager following an anonymous or low-privilege bind sequence.
Deploy network-level monitoring on port 389/636 to inspect LDAP bind sequences for the failed-PLAIN-then-second-bind pattern.

Monitoring Recommendations

Forward directory server access and error logs to a centralized analytics platform and retain them long enough to reconstruct multi-step bind sequences.
Alert on any write, modify, or ACI change performed under cn=Directory Manager from source addresses not on an administrative allowlist.
Monitor for spikes in failed SASL PLAIN binds against privileged DNs, which may indicate probing for this flaw.

How to Mitigate CVE-2026-18922

Immediate Actions Required

Apply the Red Hat security errata for 389-ds-base and Red Hat Directory Server referenced in advisories RHSA-2026:64771 through RHSA-2026:64811 as soon as they are available for your platform.
Restrict network access to LDAP ports (389/tcp, 636/tcp) to trusted management networks until patching is complete.
Rotate the Directory Manager password and audit recent directory changes for unauthorized modifications, ACI edits, or new administrative accounts.

Patch Information

Red Hat has published fixed packages across multiple product streams. See the Red Hat CVE Analysis CVE-2026-18922 page and the Red Hat Bug Report #2511388 for full component and version details. Individual errata include RHSA-2026:64771, RHSA-2026:64776, RHSA-2026:64778, RHSA-2026:64779, RHSA-2026:64780, RHSA-2026:64781, RHSA-2026:64783, RHSA-2026:64784, RHSA-2026:64785, RHSA-2026:64789, RHSA-2026:64790, RHSA-2026:64791, RHSA-2026:64792, RHSA-2026:64793, RHSA-2026:64804, and RHSA-2026:64811.

Workarounds

Disable the SASL PLAIN and SASL ANONYMOUS mechanisms by removing them from the nsslapd-allowed-sasl-mechanisms configuration until patches are applied.
Require TLS with client certificate authentication (SASL EXTERNAL) for administrative access and block plaintext bind mechanisms at the firewall.
Limit the source addresses permitted to bind as cn=Directory Manager using host-based ACLs or a bastion architecture.

bash

# Restrict allowed SASL mechanisms via dsconf until patching completes
dsconf <instance> config replace nsslapd-allowed-sasl-mechanisms="GSSAPI EXTERNAL"
# Restart the directory server to apply changes
systemctl restart dirsrv@<instance>