CVE-2026-76560
Received Received - Intake

Incorrect SELFDN ACI Evaluation in 389 Directory Server

Publication date: 2026-09-07

Last updated on: 2026-09-07

Assigner: redhat-SADP

Description
A flaw was found in 389 Directory Server. The SELFDN ACI bind-rule evaluator incorrectly matches an anonymous LDAP client's empty bind DN against an empty stored attribute value, allowing an unauthenticated client to satisfy access control checks intended to require a matching authenticated identity. This can allow an anonymous LDAP client to perform an operation, such as adding or modifying a directory entry, that a SELFDN-based ACI intended to restrict to a specific authenticated user.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-07
Last Modified
2026-09-07
Generated
2026-09-07
AI Q&A
2026-09-07
EPSS Evaluated
N/A
NVD
CVE-2026-76560
EUVD
EUVD-2026-72400

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
redhat 389_directory_server *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the 389 Directory Server where an anonymous LDAP client can bypass SELFDN-based access control checks by using an empty bind DN. The issue occurs because the server incorrectly matches an empty bind DN against an empty stored attribute value, allowing unauthorized operations like adding or modifying directory entries without authentication.

Detection Guidance

To detect this vulnerability, check if your 389 Directory Server uses SELFDN-based ACIs on attributes that allow empty values. Review ACI configurations for rules like userattr="X#SELFDN" or userattr="attribute#USERDN". Use ldapsearch to inspect ACIs and attributes: ldapsearch -x -H ldap://localhost -b "cn=config" "(aci=*)" and ldapsearch -x -H ldap://localhost -b "dc=example,dc=com" "(objectClass=*)" attribute.

Check for anonymous LDAP access enabled on the server. Verify if empty bind DNs are accepted by testing with ldapsearch -x -H ldap://localhost -b "" -s base "(objectClass=*)".

Impact Analysis

An attacker could exploit this flaw to perform unauthorized actions such as adding or modifying directory entries without authentication. This could lead to data tampering, privilege escalation, or unauthorized access to sensitive information if the server uses SELFDN-based ACIs on attributes that allow empty values.

Compliance Impact

This vulnerability could violate compliance requirements that mandate strict access controls and authentication for sensitive data, such as GDPR's data protection principles or HIPAA's access control safeguards. Unauthorized modifications to directory entries may result in non-compliance with these regulations.

Mitigation Strategies

Immediately review all SELFDN-based ACIs in your 389 Directory Server configuration. Ensure target attributes cannot hold empty values by adding constraints or validation rules.

Disable anonymous LDAP access if not required. Add authmethod restrictions to ACIs to enforce authenticated binds. Update to the latest patched version of 389-ds-base once available.

Monitor directory operations for unauthorized modifications. Consider temporarily restricting write access to sensitive entries until mitigation is complete.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-76560. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart