Fedora Account System
Red Hat Associate
Red Hat Customer
389 Directory Server's SELFDN ACI bind-rule evaluator (ldap/servers/plugins/acl/acllas.c) compares a client's bind DN against a stored attribute value using a plain string comparison. An anonymous LDAP bind has an empty-string client DN, and 389-ds's own DN syntax validator (ldap/servers/plugins/syntaxes/dn.c) accepts zero-length attribute values as valid. As a result, any ACI written as userattr="X#SELFDN", where attribute X can legitimately hold an empty value, is satisfied by an anonymous client with no authentication of any kind. This was originally reported (PSIRTSUPT-21812) as part of a FreeIPA-specific admin-takeover chain, but independently reproduced standalone against plain 389-ds-base (389-ds-base-3.2.2-2.fc44) with zero FreeIPA schema, plugins, or ACIs present: a minimal test ACI (allow (add) userattr = "owner#SELFDN") was defeated by an anonymous bind with owner: set to an empty value, while a control case (non-empty, non-matching value) was correctly refused. This confirms the defect is general to the ACI evaluation engine, not specific to any consuming application. Any 389-ds/RHDS deployment that defines a SELFDN-based ACI on an attribute permitted to hold an empty value is affected. Reported and confirmed as part of the PSIRTSUPT-21812 investigation; see linked Jira ticket for full technical writeup and reproduction evidence.
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Extended Lifecycle Support Via RHSA-2026:64771 https://access.redhat.com/errata/RHSA-2026:64771
This issue has been addressed in the following products: Red Hat Directory Server 12.2 E4S for RHEL 9 Via RHSA-2026:64779 https://access.redhat.com/errata/RHSA-2026:64779
This issue has been addressed in the following products: Red Hat Directory Server 12.4 E4S for RHEL 9 Via RHSA-2026:64780 https://access.redhat.com/errata/RHSA-2026:64780
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions Red Hat Enterprise Linux 8.8 Telecommunications Update Service Via RHSA-2026:64776 https://access.redhat.com/errata/RHSA-2026:64776
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Via RHSA-2026:64778 https://access.redhat.com/errata/RHSA-2026:64778
This issue has been addressed in the following products: Red Hat Directory Server 11.7 E4S for RHEL 8 Via RHSA-2026:64792 https://access.redhat.com/errata/RHSA-2026:64792
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions Via RHSA-2026:64781 https://access.redhat.com/errata/RHSA-2026:64781
This issue has been addressed in the following products: Red Hat Directory Server 11.9 for RHEL 8 Via RHSA-2026:64793 https://access.redhat.com/errata/RHSA-2026:64793
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On Via RHSA-2026:64789 https://access.redhat.com/errata/RHSA-2026:64789
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On Via RHSA-2026:64790 https://access.redhat.com/errata/RHSA-2026:64790
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.6 Extended Update Support Via RHSA-2026:64783 https://access.redhat.com/errata/RHSA-2026:64783
This issue has been addressed in the following products: Red Hat Enterprise Linux 10.0 Extended Update Support Via RHSA-2026:64804 https://access.redhat.com/errata/RHSA-2026:64804
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2026:64791 https://access.redhat.com/errata/RHSA-2026:64791
This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2026:64785 https://access.redhat.com/errata/RHSA-2026:64785
This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2026:64784 https://access.redhat.com/errata/RHSA-2026:64784