Bug 2511388 (CVE-2026-18922) - CVE-2026-18922 389-ds-base: 389-ds-base: SASL PLAIN authentication allows privilege escalation to Directory Manager via stale identity in Cyrus SASL auxiliary property
Summary: CVE-2026-18922 389-ds-base: 389-ds-base: SASL PLAIN authentication allows pri...
Keywords:
Status: NEW
Alias: CVE-2026-18922
Deadline: 2026-09-07
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
urgent
urgent
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-08-05 08:29 UTC by OSIDB Bzimport
Modified: 2026-09-08 05:44 UTC (History)
13 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2026:64771 0 None None None 2026-09-08 01:56:39 UTC
Red Hat Product Errata RHSA-2026:64776 0 None None None 2026-09-08 02:21:25 UTC
Red Hat Product Errata RHSA-2026:64778 0 None None None 2026-09-08 02:22:23 UTC
Red Hat Product Errata RHSA-2026:64779 0 None None None 2026-09-08 02:07:53 UTC
Red Hat Product Errata RHSA-2026:64780 0 None None None 2026-09-08 02:08:43 UTC
Red Hat Product Errata RHSA-2026:64781 0 None None None 2026-09-08 02:39:17 UTC
Red Hat Product Errata RHSA-2026:64783 0 None None None 2026-09-08 03:31:58 UTC
Red Hat Product Errata RHSA-2026:64784 0 None None None 2026-09-08 05:44:38 UTC
Red Hat Product Errata RHSA-2026:64785 0 None None None 2026-09-08 05:07:32 UTC
Red Hat Product Errata RHSA-2026:64789 0 None None None 2026-09-08 02:42:43 UTC
Red Hat Product Errata RHSA-2026:64790 0 None None None 2026-09-08 02:47:44 UTC
Red Hat Product Errata RHSA-2026:64791 0 None None None 2026-09-08 04:36:55 UTC
Red Hat Product Errata RHSA-2026:64792 0 None None None 2026-09-08 02:38:46 UTC
Red Hat Product Errata RHSA-2026:64793 0 None None None 2026-09-08 02:39:36 UTC
Red Hat Product Errata RHSA-2026:64804 0 None None None 2026-09-08 03:47:05 UTC
Red Hat Product Errata RHSA-2026:64811 0 None None None 2026-09-08 03:15:42 UTC

Description OSIDB Bzimport 2026-08-05 08:29:01 UTC
A flaw was found in 389 Directory Server (389-ds-base). During SASL PLAIN authentication, the ids_sasl_canon_user() function writes the resolved bind DN into a Cyrus SASL auxiliary property (prop_set) on every canonicalization attempt, including failed ones. A failed one-shot PLAIN exchange does not trigger SASL-context recreation in ids_sasl_check_bind() -- that only happens when CONN_FLAG_SASL_COMPLETE or continuing is already set. A subsequent successful SASL bind on the same connection retrieves the auxiliary property via prop_getnames() and unconditionally trusts only the first stored value (dnval[0].values[0]), with no check on which SASL mechanism completed the second exchange and no check that the value corresponds to the identity actually just authenticated.

An unprivileged remote attacker can exploit this with zero valid credentials: first send a SASL PLAIN bind as cn=Directory Manager with an incorrect password (fails as expected, but leaves the Directory Manager DN in slot 0 of the auxiliary property), then complete a SASL ANONYMOUS bind on the same connection. The server installs the stale Directory Manager identity instead of the anonymous identity, granting full Directory Manager authority. This was independently confirmed by Red Hat Product Security in an isolated, network-disconnected sandbox against 389-ds-base-2.9.0: "Who Am I?" returned "cn=directory manager", and the Directory-Manager-only cn=config attribute nsslapd-rootdn became readable. The same stale-identity mechanism also allows escalation via a valid low-privileged account's own successful second bind (originally reported variant, requiring one valid account), independently reproduced against the reporter's own PoC.

Root cause: ldap/servers/slapd/saslbind.c, ids_sasl_canon_user() (identity write, unconditional per mechanism) and ids_sasl_check_bind() (identity read-back and installation, no mechanism check, no freshness check). Verified directly against commit 33c0e0115c03017ba94ee02f144383704de32a25; unchanged since a September 2024 logging-format cleanup.

Comment 1 errata-xmlrpc 2026-09-08 01:56:38 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7 Extended Lifecycle Support

Via RHSA-2026:64771 https://access.redhat.com/errata/RHSA-2026:64771

Comment 2 errata-xmlrpc 2026-09-08 02:07:52 UTC
This issue has been addressed in the following products:

  Red Hat Directory Server 12.2 E4S for RHEL 9

Via RHSA-2026:64779 https://access.redhat.com/errata/RHSA-2026:64779

Comment 3 errata-xmlrpc 2026-09-08 02:08:42 UTC
This issue has been addressed in the following products:

  Red Hat Directory Server 12.4 E4S for RHEL 9

Via RHSA-2026:64780 https://access.redhat.com/errata/RHSA-2026:64780

Comment 4 errata-xmlrpc 2026-09-08 02:21:24 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.8 Telecommunications Update Service

Via RHSA-2026:64776 https://access.redhat.com/errata/RHSA-2026:64776

Comment 5 errata-xmlrpc 2026-09-08 02:22:22 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2026:64778 https://access.redhat.com/errata/RHSA-2026:64778

Comment 6 errata-xmlrpc 2026-09-08 02:38:44 UTC
This issue has been addressed in the following products:

  Red Hat Directory Server 11.7 E4S for RHEL 8

Via RHSA-2026:64792 https://access.redhat.com/errata/RHSA-2026:64792

Comment 7 errata-xmlrpc 2026-09-08 02:39:16 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions

Via RHSA-2026:64781 https://access.redhat.com/errata/RHSA-2026:64781

Comment 8 errata-xmlrpc 2026-09-08 02:39:35 UTC
This issue has been addressed in the following products:

  Red Hat Directory Server 11.9 for RHEL 8

Via RHSA-2026:64793 https://access.redhat.com/errata/RHSA-2026:64793

Comment 9 errata-xmlrpc 2026-09-08 02:42:42 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On

Via RHSA-2026:64789 https://access.redhat.com/errata/RHSA-2026:64789

Comment 10 errata-xmlrpc 2026-09-08 02:47:43 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On

Via RHSA-2026:64790 https://access.redhat.com/errata/RHSA-2026:64790

Comment 11 errata-xmlrpc 2026-09-08 03:15:41 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6 Extended Lifecycle Support  - EXTENSION

Via RHSA-2026:64811 https://access.redhat.com/errata/RHSA-2026:64811

Comment 12 errata-xmlrpc 2026-09-08 03:31:57 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:64783 https://access.redhat.com/errata/RHSA-2026:64783

Comment 13 errata-xmlrpc 2026-09-08 03:47:04 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:64804 https://access.redhat.com/errata/RHSA-2026:64804

Comment 14 errata-xmlrpc 2026-09-08 04:36:53 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:64791 https://access.redhat.com/errata/RHSA-2026:64791

Comment 15 errata-xmlrpc 2026-09-08 05:07:30 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:64785 https://access.redhat.com/errata/RHSA-2026:64785

Comment 16 errata-xmlrpc 2026-09-08 05:44:36 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:64784 https://access.redhat.com/errata/RHSA-2026:64784


Note You need to log in before you can comment on or make changes to this bug.