CVE-2026-19404: 389 Directory Server Auth Bypass Flaw

CVE-2026-19404 Overview

CVE-2026-19404 is a missing authorization vulnerability [CWE-862] in 389 Directory Server. The flaw resides in the CleanAllRUV and Abort CleanAllRUV replication-maintenance extended operations, which perform no authorization checks before execution. An unauthenticated remote attacker can invoke these operations when nsslapd-allow-anonymous-access is enabled, which is the default configuration. When anonymous access is disabled, any authenticated low-privilege user can still trigger the operations. Successful exploitation removes replica IDs from replication metadata, purges changelog records, and interrupts administrator-initiated cleanup tasks. The result is inconsistent or unavailable replication across directory topologies.

Critical Impact
Remote attackers can disrupt LDAP replication integrity and availability without authentication in default configurations, undermining directory service consistency across the environment.

Affected Products

389 Directory Server (Red Hat Directory Server)
Deployments with nsslapd-allow-anonymous-access enabled (default)
Multi-supplier replication topologies using CleanAllRUV operations

Discovery Timeline

2026-08-10 - CVE-2026-19404 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-19404

Vulnerability Analysis

The 389 Directory Server implements replication housekeeping through two LDAP extended operations: CleanAllRUV and Abort CleanAllRUV. The CleanAllRUV operation removes obsolete replica identifiers from the Replica Update Vector (RUV) and purges associated changelog entries across all replicas in a topology. The Abort CleanAllRUV operation halts an in-progress cleanup task. Both operations affect replication state across the entire directory topology.

The vulnerable code paths dispatch these extended operations without validating the caller's identity or privileges. When nsslapd-allow-anonymous-access is set to its default value, any network client can bind anonymously and issue the operations. When anonymous access is restricted, the server still fails to enforce that only Directory Manager or replication administrators may invoke the operations, so any authenticated user with minimal privileges can execute them.

Root Cause

The root cause is a missing authorization check [CWE-862] in the extended operation handlers for CleanAllRUV and Abort CleanAllRUV. Neither handler verifies whether the requesting connection holds the administrative rights required to modify replication metadata. Server-side privilege enforcement is absent, so authorization defaults to whatever access the underlying bind provides.

Attack Vector

Exploitation requires network access to the LDAP port (389/636) of an affected 389 Directory Server instance. An attacker crafts an LDAP extended operation request targeting the CleanAllRUV OID and supplies a target replica ID. In default configurations, the attacker binds anonymously and sends the request. The server processes the operation, removes the specified replica ID from the RUV, and propagates the change across the topology. Repeated invocations or targeting active replica IDs can render replication inconsistent, halt synchronization, or force manual recovery by administrators.

No verified public exploit is available. Refer to the Red Hat CVE Advisory and the Red Hat Bug Report for technical details.

Detection Methods for CVE-2026-19404

Indicators of Compromise

Unexpected CleanAllRUV or Abort CleanAllRUV extended operation entries in the 389 Directory Server access log, particularly from anonymous binds or non-administrative accounts.
Missing replica IDs in the RUV output of cn=config or cn=replica entries that were previously present.
Unexplained changelog truncation or replication task interruptions logged in errors or access logs.

Detection Strategies

Monitor LDAP access logs for extended operation OIDs associated with CleanAllRUV (2.16.840.1.113730.3.5.12 and related task OIDs) originating from unexpected source IPs or bind DNs.
Alert on any invocation of replication-maintenance operations by principals other than Directory Manager or designated replication administrators.
Compare RUV state across replicas at regular intervals; flag unexpected removals of replica IDs.

Monitoring Recommendations

Ingest 389 Directory Server access and error logs into a central analytics pipeline and correlate extended operation activity with bind identity.
Track anonymous bind volume against baselines and alert on anomalous spikes tied to extended operations.
Establish alerting on replication task events such as CleanAllRUV Task entries in cn=tasks to catch unauthorized triggers in real time.

How to Mitigate CVE-2026-19404

Immediate Actions Required

Apply vendor patches for 389 Directory Server as released through Red Hat and upstream distributions once available.
Disable anonymous access by setting nsslapd-allow-anonymous-access to off or rootdse to reduce the unauthenticated attack surface.
Restrict network access to LDAP ports 389 and 636 to trusted administrative networks and replication peers only.
Audit existing bind accounts and remove unnecessary low-privilege accounts that could be used to invoke the operations.

Patch Information

Red Hat has tracked this issue in Bugzilla 2513036. Consult the Red Hat CVE Advisory for the current fix status, affected package versions, and errata references applicable to your distribution.

Workarounds

Set nsslapd-allow-anonymous-access: off to prevent unauthenticated invocation of the extended operations.
Enforce network-layer access controls with firewalls or LDAP proxies to restrict who can reach the directory server.
Monitor and alert on all CleanAllRUV task creation events until patches are applied and validated.

bash

# Configuration example: disable anonymous access via ldapmodify
ldapmodify -D "cn=Directory Manager" -W -x <<EOF
dn: cn=config
changetype: modify
replace: nsslapd-allow-anonymous-access
nsslapd-allow-anonymous-access: off
EOF