CVE-2026-11770
Received Received - Intake

LDAP Filter Injection in 389 Directory Server

Publication date: 2026-07-31

Last updated on: 2026-07-31

Assigner: Red Hat, Inc.

Description
A flaw was found in 389 Directory Server. An unauthenticated remote attacker can inject LDAP search filters into the CleanAllRUV replication status-check extended operation. Because the handler performs the search against cn=config with elevated replication plugin privileges and returns a boolean match result, the attacker can extract sensitive server configuration metadata, including replication bind DNs and password storage scheme information.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-31
Last Modified
2026-07-31
Generated
2026-07-31
AI Q&A
2026-07-31
EPSS Evaluated
N/A
NVD
CVE-2026-11770
EUVD
EUVD-2026-51510

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
redhat 389_directory_server *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-90 The product constructs all or part of an LDAP query using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended LDAP query when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in 389 Directory Server. An unauthenticated remote attacker can inject LDAP search filters into the CleanAllRUV replication status-check operation. The handler searches cn=config with high privileges and returns a boolean result, allowing the attacker to extract sensitive server configuration details like replication bind DNs and password storage schemes.

Detection Guidance

To detect this vulnerability, monitor for unusual LDAP search filter activity targeting the CleanAllRUV extended operation (OID 2.16.840.1.113730.3.6.8). Check logs for anonymous binds with filter injections against cn=config. Use ldapsearch with crafted filters to test if the server leaks configuration metadata.

Impact Analysis

An attacker could gain access to sensitive server configuration data, including credentials and encryption details. This could lead to further attacks like privilege escalation or unauthorized access to directory services.

Compliance Impact

This vulnerability could expose sensitive data, violating GDPR's data protection principles or HIPAA's security requirements for protected health information. Organizations may face compliance penalties if exploited.

Mitigation Strategies

Update 389 Directory Server to the latest patched version immediately to address the LDAP search filter injection flaw in the CleanAllRUV operation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-11770. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart