CVE-2026-86345: 389 Directory Server Auth Bypass Vulnerability

CVE-2026-86345 Overview

A flaw in the 389 Directory Server (389-ds-base) allows an on-path attacker to subvert StartTLS negotiation. The server fails to discard plaintext bytes already buffered from the client connection before upgrading to Transport Layer Security (TLS). An attacker positioned between the client and the Lightweight Directory Access Protocol (LDAP) server can inject a crafted LDAP message that is processed after the TLS upgrade. The injected response reaches the client in place of its own pending operation's response due to a messageID collision. Client applications can treat a failed bind as a successful authentication, breaking the integrity of LDAP authentication across any application relying on this directory service.

Critical Impact

An on-path attacker can convert a failed LDAP bind into an apparent success, bypassing authentication for any application using the vulnerable 389 Directory Server.

Affected Products

• Red Hat 389 Directory Server (389-ds-base)
• LDAP client applications performing StartTLS against affected server builds
• Downstream distributions bundling 389-ds-base (see vendor advisory)

Discovery Timeline

• 2026-10-02 - CVE-2026-86345 published to the National Vulnerability Database
• 2026-10-07 - Last updated in NVD database

Technical Details for CVE-2026-86345

Vulnerability Analysis

The vulnerability is a trust boundary violation during protocol upgrade, classified under [CWE-923: Improper Restriction of Communication Channel to Intended Endpoints]. StartTLS is an LDAP extended operation that upgrades a plaintext connection to TLS in place. A correct implementation must drain and discard any bytes received from the socket between the StartTLS request and the completion of the TLS handshake. The 389 Directory Server retains those plaintext bytes and parses them as LDAP messages after the handshake succeeds.

The server therefore treats attacker-controlled plaintext as if it arrived inside the encrypted channel. The injected message carries a messageID chosen to collide with a pending client operation. When the server replies, the client associates the attacker-crafted response with its own request.

Root Cause

The root cause is improper buffer handling at the TLS upgrade boundary. The input buffer that accumulates bytes before STARTTLS completes is not flushed before the server begins reading from the newly established TLS session. There is also no post-upgrade validation that LDAP messages originate from the encrypted stream rather than from pre-upgrade plaintext.

Attack Vector

Exploitation requires network-adjacent, on-path position between client and server, which raises attack complexity. The attack proceeds as follows:

1. The client opens an LDAP connection and issues STARTTLS.
2. The attacker injects an LDAP BindResponse with resultCode: success and a messageID matching the client's upcoming bind request.
3. The server buffers the injected bytes but does not discard them.
4. The TLS handshake completes.
5. The server parses the attacker's buffered message post-upgrade and delivers the forged BindResponse to the client.
6. The client treats the failed or non-existent authentication as successful.

No code examples are published for this issue. See the Red Hat CVE-2026-86345 Advisory and Red Hat Bug Report #2529332 for additional detail.

Detection Methods for CVE-2026-86345

Indicators of Compromise

• LDAP sessions where BindResponse messages arrive before the client's BindRequest is transmitted inside the TLS tunnel.
• Successful authentication events for accounts that have no valid credential material or that failed the preceding attempt.
• Unusual messageID reuse patterns in 389-ds-base access logs immediately after STARTTLS.
• Unexpected TCP retransmissions or out-of-order segments around the StartTLS exchange on port 389.

Detection Strategies

• Inspect 389-ds-base access logs for STARTTLS operations followed by bind results that do not correlate with downstream application authentication telemetry.
• Correlate directory bind successes with endpoint and application sign-in events to flag ghost authentications.
• Deploy network sensors that validate TLS record boundaries follow immediately after the ServerHello on LDAP sessions.

Monitoring Recommendations

• Enable verbose LDAP connection logging and forward it to a centralized analytics platform for correlation.
• Alert on authentication anomalies such as binds succeeding without a corresponding password validation event.
• Monitor for man-in-the-middle indicators on segments carrying LDAP traffic, including ARP anomalies and unexpected gateway changes.

How to Mitigate CVE-2026-86345

Immediate Actions Required

• Apply the vendor-supplied 389-ds-base update as soon as it is available from your distribution.
• Require LDAPS (ldaps:// on port 636) instead of StartTLS for all client applications until patched builds are deployed.
• Audit directory bind logs for the past 90 days for anomalous successful authentications following STARTTLS.

Patch Information

Refer to the Red Hat CVE-2026-86345 Advisory and Red Hat Bug Report #2529332 for fixed package versions and errata. Rebuild or restart the dirsrv instance after upgrading so the patched binary is loaded.

Workarounds

• Disable StartTLS on affected directory instances and enforce implicit TLS via LDAPS on port 636.
• Restrict LDAP traffic to trusted network segments and enforce mutual TLS where supported.
• Require client certificate authentication (SASL EXTERNAL) so forged BindResponse messages cannot satisfy credential checks.

# Disable StartTLS and require LDAPS on 389 Directory Server
dsconf <instance> config replace nsslapd-allow-anonymous-access=off
dsconf <instance> security disable_starttls
dsconf <instance> security set --secure-port=636 --security=on
systemctl restart dirsrv@<instance>