CVE-2026-18922
Received Received - Intake

SASL Authentication Bypass in 389 Directory Server

Publication date: 2026-09-07

Last updated on: 2026-09-07

Assigner: redhat-SADP

Description
A flaw was found in 389 Directory Server. During SASL PLAIN authentication, a stale identity carried in a Cyrus SASL auxiliary property from a prior failed bind attempt can be installed on a connection following a subsequent, unrelated successful bind, regardless of which SASL mechanism completes that second bind. An attacker can send a SASL PLAIN bind as cn=Directory Manager with an incorrect password, then complete a SASL ANONYMOUS bind on the same connection, causing the server to grant Directory Manager authority without any valid credentials. A variant using a valid low-privileged account's own successful bind instead of an anonymous one is also possible.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-07
Last Modified
2026-09-07
Generated
2026-09-07
AI Q&A
2026-09-07
EPSS Evaluated
N/A
NVD
CVE-2026-18922
EUVD
EUVD-2026-72457

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
redhat 389_directory_server *
red_hat 389_directory_server From 2.9.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the 389 Directory Server and allows an unauthenticated remote attacker to gain full Directory Manager privileges without valid credentials. It occurs during SASL PLAIN authentication when a failed bind attempt as cn=Directory Manager with an incorrect password leaves a stale identity in a Cyrus SASL auxiliary property. This stale identity can then be exploited by completing a subsequent SASL ANONYMOUS bind on the same connection, granting unauthorized Directory Manager access.

Detection Guidance

To detect this vulnerability, monitor for unexpected Directory Manager privilege assignments or unusual SASL ANONYMOUS binds following failed SASL PLAIN attempts. Check logs for repeated failed binds as cn=Directory Manager and subsequent successful binds with elevated privileges. Use commands like 'journalctl -u dirsrv@* -n 1000' to review 389 Directory Server logs for suspicious authentication sequences.

Impact Analysis

An attacker can exploit this to gain full control over the 389 Directory Server, compromising confidentiality, integrity, and availability. This includes unauthorized access to sensitive data, modification or deletion of data, and potential disruption of services. The attack requires no user interaction or non-default configuration.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements for data protection and access control. Non-compliance may result in legal penalties, fines, and reputational damage due to compromised data integrity and confidentiality.

Mitigation Strategies

Immediately restrict SASL mechanisms to exclude PLAIN by editing the server configuration to set 'nsslapd-allowed-sasl-mechanisms: ANONYMOUS GSSAPI DIGEST-MD5 EXTERNAL' in dse.ldif. Restart the 389 Directory Server service afterward. Additionally, monitor for any signs of exploitation and update to a patched version once available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18922. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart