CVE-2026-19843
Received Received - Intake

BaseFortify

Publication date: 2026-09-07

Last updated on: 2026-09-07

Assigner: redhat-SADP

Description
A flaw was found in 389-ds-base. The Cockpit 389 Console's LDAP editor constructs an ldapsearch command by embedding an LDAP entry's distinguished name (DN) into a shell command string without proper escaping. An LDAP user with delegated privileges to create or rename directory entries could craft a malicious DN containing shell metacharacters. When a Cockpit administrator subsequently views the entry in the 389 Console, the embedded shell command executes with root privileges on the directory server host.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-07
Last Modified
2026-09-07
Generated
2026-09-07
AI Q&A
2026-09-07
EPSS Evaluated
N/A
NVD
CVE-2026-19843
EUVD
EUVD-2026-72458

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
redhat 389-ds-base *
redhat cockpit_389_console *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-19843 is a command injection flaw in the Red Hat Directory Server's Cockpit 389 Console. The vulnerability occurs when the LDAP editor constructs an ldapsearch command by embedding an LDAP entry's distinguished name (DN) into a shell command without proper escaping. An attacker with delegated LDAP privileges can craft a malicious DN containing shell metacharacters. When a privileged Cockpit administrator views the entry, the embedded shell command executes with root privileges on the directory server host.

Detection Guidance

Check if the Cockpit 389 Console is installed and running on your system. Review LDAP entries for suspicious DNs containing shell metacharacters or unusual patterns. Examine system logs for unexpected command executions from the 389-ds-base process.

Impact Analysis

This vulnerability allows an attacker with LDAP write privileges to execute arbitrary commands as root on the directory server host. This could lead to full system compromise, including unauthorized access to sensitive data, modification or deletion of critical files, and disruption of services. The impact is severe due to the root privileges gained and the potential to bypass security controls like SELinux.

Compliance Impact

This vulnerability could lead to unauthorized access or modification of sensitive data, violating confidentiality and integrity requirements under GDPR and HIPAA. Organizations using affected systems may face compliance violations, legal penalties, and reputational damage due to potential data breaches or loss of data integrity.

Mitigation Strategies

Restrict access to the Cockpit 389 Console to only trusted administrators. Remove delegated LDAP add/rename privileges from untrusted accounts until a patch is applied. Disable the Cockpit 389 Console if not required.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19843. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart