CVE-2026-76560: 389 Directory Server Auth Bypass Vulnerability

CVE-2026-76560 Overview

A flaw in the 389 Directory Server allows anonymous LDAP clients to bypass access control checks tied to the SELFDN ACI bind rule. The bind-rule evaluator incorrectly matches an anonymous client's empty bind Distinguished Name (DN) against an empty stored attribute value. As a result, an unauthenticated client can satisfy ACI checks designed to restrict operations to a specific authenticated user. An attacker can add or modify directory entries that were intended to be protected. The weakness is classified as Incorrect Authorization [CWE-863] and affects Red Hat Directory Server and related distributions.

Critical Impact
Unauthenticated network attackers can perform write operations on LDAP entries protected by SELFDN ACIs, undermining directory integrity.

Affected Products

Red Hat Directory Server (see referenced RHSA advisories)
Red Hat Enterprise Linux Identity Management (IdM) components using 389-ds-base
Upstream 389 Directory Server distributions incorporating the vulnerable SELFDN evaluator

Discovery Timeline

2026-09-07 - CVE-2026-76560 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-76560

Vulnerability Analysis

The 389 Directory Server uses Access Control Instructions (ACIs) to define which identities may perform operations on directory entries. The SELFDN bind rule restricts access so that only an authenticated user whose bind DN matches a specific attribute value on the target entry can act on it. This rule is commonly used to allow a service or user to modify entries that reference their own DN.

The flaw resides in how the bind-rule evaluator compares the client's authenticated identity to the stored attribute value. When an anonymous LDAP client connects, its bind DN is empty. When the target entry contains an empty attribute value in the field checked by SELFDN, the evaluator treats the two empty strings as a match and grants access.

Root Cause

The root cause is an equivalence check that does not exclude the anonymous case. The evaluator compares strings without first validating that the bind DN is non-empty and that the client is authenticated. Under [CWE-863] Incorrect Authorization, the code path reaches an allow decision using inputs that should have been rejected before the comparison occurs.

Attack Vector

Exploitation is unauthenticated and network-based. An attacker connects to the LDAP service, issues an anonymous bind, and then submits an add or modify request against an entry protected by a SELFDN ACI where the referenced attribute is empty or absent. The server evaluates the ACI, matches the empty bind DN to the empty attribute value, and authorizes the operation. No user interaction is required, and attack complexity is low.

No verified public exploit code is currently available. Refer to the Red Hat CVE Analysis for CVE-2026-76560 and Red Hat Bug #2519521 for further technical detail.

Detection Methods for CVE-2026-76560

Indicators of Compromise

Successful LDAP add or modify operations logged with an empty or anonymous bind DN in the 389-ds access log.
Unexpected changes to entries protected by SELFDN-based ACIs, particularly where the referenced attribute value is empty.
Anomalous spikes in anonymous bind activity followed by write operations against sensitive directory subtrees.

Detection Strategies

Enable and review 389-ds access logging with nsslapd-accesslog-level configured to capture bind and modification events.
Audit ACIs in the directory tree and identify any SELFDN rule where the referenced attribute may be missing or empty on live entries.
Correlate LDAP write operations with the authenticated identity of the connection; flag any writes tied to anonymous binds.

Monitoring Recommendations

Forward 389-ds access and audit logs to a central logging or SIEM platform for long-term retention and correlation.
Establish a baseline for anonymous bind volume and alert on deviations that coincide with write operations.
Track changes to directory ACIs and privileged entries using directory change auditing.

How to Mitigate CVE-2026-76560

Immediate Actions Required

Apply the vendor-provided patches from the referenced Red Hat Security Advisories, including RHSA-2026:64771 and related errata, as soon as available for your platform.
Inventory all ACIs that use the SELFDN bind rule and confirm that the referenced attribute is populated on every entry it protects.
Restrict anonymous bind capability where operationally feasible by setting nsslapd-allow-anonymous-access to off or rootdse.

Patch Information

Red Hat has issued multiple advisories addressing this flaw across supported product streams. Consult the Red Hat CVE page for CVE-2026-76560 for the definitive list of fixed package versions, and apply the advisory matching your distribution, including RHSA-2026:64776, RHSA-2026:64778, RHSA-2026:64779, RHSA-2026:64780, RHSA-2026:64781, RHSA-2026:64783, RHSA-2026:64784, RHSA-2026:64785, RHSA-2026:64789, RHSA-2026:64790, RHSA-2026:64791, RHSA-2026:64792, RHSA-2026:64793, RHSA-2026:64804, and RHSA-2026:65119.

Workarounds

Disable anonymous binds on directory instances that do not require them.
Ensure that any attribute referenced by a SELFDN ACI is always populated with a non-empty value on protected entries, or replace SELFDN with an explicit user or group bind rule.
Limit network exposure of the LDAP service using firewall rules so that only trusted management networks can reach the directory ports.

bash

# Configuration example: disable anonymous access on 389-ds
dsconf <instance-name> config replace nsslapd-allow-anonymous-access=off

# Verify current setting
dsconf <instance-name> config get nsslapd-allow-anonymous-access