CVE-2026-19843: 389-ds-base LDAP Editor RCE Vulnerability

CVE-2026-19843 Overview

A command injection flaw exists in the 389-ds-base directory server, specifically in the Cockpit 389 Console's LDAP editor. The console builds an ldapsearch command by embedding an LDAP entry's distinguished name (DN) directly into a shell command string without escaping. An authenticated LDAP user with delegated permissions to create or rename entries can craft a malicious DN containing shell metacharacters. When a Cockpit administrator later views that entry, the embedded shell payload executes with root privileges on the directory server host. The issue is tracked as [CWE-78] OS Command Injection and affects Red Hat Directory Server and downstream distributions of 389-ds-base.

Critical Impact
A low-privileged LDAP user can achieve root-level remote code execution on the directory server when an administrator views a malicious entry in the Cockpit 389 Console.

Affected Products

Red Hat Directory Server (389-ds-base package)
Red Hat Enterprise Linux distributions shipping 389-ds-base with the Cockpit 389 Console plugin
Fedora and downstream builds of 389-ds-base incorporating the vulnerable LDAP editor

Discovery Timeline

2026-09-07 - CVE-2026-19843 published to the National Vulnerability Database
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-19843

Vulnerability Analysis

The Cockpit 389 Console provides a web-based administrative interface for managing 389-ds-base directory servers. Its LDAP editor invokes the ldapsearch binary to retrieve entry attributes when an administrator opens an entry for viewing. The console constructs the shell command by concatenating the entry's distinguished name into a command string that is then evaluated by a shell interpreter. Because the DN is treated as trusted input, shell metacharacters embedded in the DN are interpreted by the shell rather than passed literally to ldapsearch. The command executes in the security context of the Cockpit administrator session, which typically runs as root on the directory host. This turns any LDAP entry with attacker-controlled naming into a stored payload that fires at administrator view time.

Root Cause

The root cause is unsafe command construction: user-controlled data (the DN) is interpolated into a shell command string without quoting, escaping, or the use of a parameterized exec-style invocation. LDAP DN syntax permits a broad set of characters, and the console does not enforce a strict allowlist before passing the value to the shell. This is a textbook instance of [CWE-78] Improper Neutralization of Special Elements used in an OS Command.

Attack Vector

Exploitation requires an authenticated LDAP identity that holds delegated privileges to add or rename directory entries under any subtree the administrator may browse. The attacker creates or renames an entry whose relative distinguished name contains shell metacharacters and a command payload, for example using backticks, $(...) substitution, or a ; terminator followed by arbitrary commands. The payload lies dormant in the directory until a Cockpit administrator opens the containing subtree in the 389 Console. At that point the console constructs and executes the shell string, running the injected commands as root on the directory server host. User interaction from a privileged administrator is required, which is reflected in the CVSS UI:R metric.

No verified public proof-of-concept code is available. See the Red Hat CVE Analysis for CVE-2026-19843 and Red Hat Bug Report #2515965 for vendor technical details.

Detection Methods for CVE-2026-19843

Indicators of Compromise

LDAP entries whose DN or RDN attribute values contain shell metacharacters such as `, $(, ;, |, &, or newline characters.
Unexpected child processes of the Cockpit cockpit-bridge or 389-console processes, particularly shells (sh, bash) or network utilities spawned as root.
New or modified files under /etc, /root, or /var/lib/dirsrv created shortly after an administrator opened the 389 Console.
Outbound network connections initiated by the directory server host immediately after LDAP browse activity.

Detection Strategies

Audit the LDAP directory for entries containing suspicious DN characters using ldapsearch with a filter that surfaces non-standard RDN values.
Enable process auditing (auditd, execve rules) on directory server hosts to record command executions spawned by Cockpit processes.
Correlate Cockpit session activity with subsequent shell invocations and privileged file writes on the directory server host.

Monitoring Recommendations

Forward 389-ds-base access logs, Cockpit session logs, and host process telemetry to a central analytics platform for correlation.
Alert on any execve event where the parent is a Cockpit-related process and the argument list contains DN-like strings with metacharacters.
Track delegated write permissions in the directory and review which identities can create or rename entries in subtrees administrators regularly browse.

How to Mitigate CVE-2026-19843

Immediate Actions Required

Apply the fixed 389-ds-base package from the applicable Red Hat Security Advisory as soon as it is available for your platform.
Restrict Cockpit 389 Console access to trusted administrators and disable the console on hosts where it is not required.
Review and tighten LDAP ACIs so that only trusted identities hold add or modrdn privileges on production subtrees.
Audit existing directory entries for DN values containing shell metacharacters and quarantine any suspicious entries before opening them in the console.

Patch Information

Red Hat has published fixed packages under multiple advisories, including RHSA-2026:64768, RHSA-2026:64769, RHSA-2026:64779, RHSA-2026:64780, RHSA-2026:64782, RHSA-2026:64792, RHSA-2026:64793, and RHSA-2026:65375. Consult the Red Hat CVE Analysis for CVE-2026-19843 for the mapping of advisories to product versions and apply the update that matches your deployment.

Workarounds

Stop and disable the Cockpit 389 Console service on directory hosts until patches are applied, and manage the directory through dsconf or other command-line tools.
Remove or reduce delegated add and modrdn privileges for non-administrative accounts to shrink the pool of identities that can plant malicious DNs.
Avoid opening unfamiliar subtrees in the Cockpit LDAP editor and inspect new entries with a text-mode client such as ldapsearch before browsing them in the web console.

bash

# Temporarily disable the Cockpit socket to prevent access to the 389 Console
systemctl stop cockpit.socket
systemctl disable cockpit.socket

# Identify LDAP entries whose DN contains shell metacharacters
ldapsearch -LLL -o ldif-wrap=no -b "dc=example,dc=com" dn | \
  grep -E '`|\$\(|;|\||&'