Bug 2515965 (CVE-2026-19843)

Summary:	CVE-2026-19843 389-ds-base: 389-ds-base: Command injection via unescaped LDAP DN in Cockpit 389 Console LDAP editor
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	aadhikar, bsmejkal, jachapma, mreynolds, progier, rhel-process-autobot, security-response-team, snegrini, spichugi, tbordaz, vashirov, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in 389-ds-base. The Cockpit 389 Console's LDAP editor constructs an ldapsearch command by embedding an LDAP entry's distinguished name (DN) into a shell command string without proper escaping. An LDAP user with delegated privileges to create or rename directory entries could craft a malicious DN containing shell metacharacters. When a Cockpit administrator subsequently views the entry in the 389 Console, the embedded shell command executes with root privileges on the directory server host.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Deadline:	2026-09-01

Description OSIDB Bzimport 2026-08-14 08:05:55 UTC

A flaw was found in 389-ds-base's Cockpit 389 Console (cockpit-389-ds), specifically in the LDAP editor's utils.jsx (getBaseLevelEntryAttributes() and runGenericSearch(), the latter reached via retrieveAllAcis()). These functions build an ldapsearch command line by concatenating a raw LDAP entry DN into a double-quoted string passed to `/usr/bin/sh -c`, executed via Cockpit's privileged (`superuser: true`) channel, which runs as unrestricted root with no capability restriction or SELinux confinement (verified directly against Cockpit's own superuser.py implementation and the absence of any Cockpit-specific SELinux policy module).

Double-quoted shell strings do not block `$(...)` command substitution, and LDAP DN syntax does not require `$`, `(`, or `)` to be escaped. An LDAP account holding a delegated create/rename privilege over some subtree (e.g. a `user_admin`- or `group_admin`-scoped role, or full Directory Administrators -- confirmed against 389-ds-base's own default sample-entries ACI templates in lib389) can create or rename an entry whose DN contains a shell command substitution, e.g. `uid=$(id > /tmp/pwned),ou=people,dc=example,dc=com`. When a separate, more-privileged Cockpit operator subsequently views that entry (or opens "Manage ACIs" on it) in the 389 Console, the injected command executes as root on the underlying host, independent of whether the ldapsearch call itself succeeds.

This has been confirmed via source-level analysis, an isolated command-execution sandbox test using the real upstream code, and a full end-to-end reproduction against a running ns-slapd + Cockpit stack using the actual shipped cockpit-389-ds package (Fedora build, confirmed to contain the identical vulnerable pattern), triggered through the real browser UI.

This is a Red Hat Directory Server-only issue. Plain RHEL does not build the cockpit-389-ds subpackage (independently verified via build manifests across RHEL 9 and RHEL 10) and is not affected.

Reported by Andrew Rukin (Arenadata) via PSIRTSUPT-21156. Confirmed as a genuine bug by 389-ds-base maintainers.

Comment 1 errata-xmlrpc 2026-09-08 00:57:15 UTC

This issue has been addressed in the following products:

  Red Hat Directory Server 13.0 EUS for RHEL 10

Via RHSA-2026:64769 https://access.redhat.com/errata/RHSA-2026:64769

Comment 2 errata-xmlrpc 2026-09-08 00:57:18 UTC

This issue has been addressed in the following products:

  Red Hat Directory Server 13.2 for RHEL 10

Via RHSA-2026:64768 https://access.redhat.com/errata/RHSA-2026:64768

Comment 3 errata-xmlrpc 2026-09-08 02:07:54 UTC

This issue has been addressed in the following products:

  Red Hat Directory Server 12.2 E4S for RHEL 9

Via RHSA-2026:64779 https://access.redhat.com/errata/RHSA-2026:64779

Comment 4 errata-xmlrpc 2026-09-08 02:08:42 UTC

This issue has been addressed in the following products:

  Red Hat Directory Server 12.4 E4S for RHEL 9

Via RHSA-2026:64780 https://access.redhat.com/errata/RHSA-2026:64780

Comment 5 errata-xmlrpc 2026-09-08 02:14:00 UTC

This issue has been addressed in the following products:

  Red Hat Directory Server 12.6 EUS for RHEL 9

Via RHSA-2026:64782 https://access.redhat.com/errata/RHSA-2026:64782

Comment 6 errata-xmlrpc 2026-09-08 02:38:47 UTC

This issue has been addressed in the following products:

  Red Hat Directory Server 11.7 E4S for RHEL 8

Via RHSA-2026:64792 https://access.redhat.com/errata/RHSA-2026:64792

Comment 7 errata-xmlrpc 2026-09-08 02:39:38 UTC

This issue has been addressed in the following products:

  Red Hat Directory Server 11.9 for RHEL 8

Via RHSA-2026:64793 https://access.redhat.com/errata/RHSA-2026:64793

Comment 8 errata-xmlrpc 2026-09-08 11:21:41 UTC

This issue has been addressed in the following products:

  Red Hat Directory Server 12.8 for RHEL 9

Via RHSA-2026:65375 https://access.redhat.com/errata/RHSA-2026:65375

Comment 9 Jon Orris 2026-10-08 13:45:42 UTC

This issue has been addressed in the following products:

  Red Hat Directory Server 11.5 E4S for RHEL 8

Via RHSA-2026:79217 https://access.redhat.com/errata/RHSA-2026:79217