{"id":"CVE-2026-19843","title":"A flaw was found in 389-ds-base","summary":"A flaw was found in 389-ds-base. The Cockpit 389 Console's LDAP editor constructs an ldapsearch command by embedding an LDAP entry's distinguished name (DN) into a shell command string without proper escaping. An LDAP user with delegated…","severity":"high","cvss":8.4,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","cwe":["CWE-78"],"vendor":"Red Hat","product":"redhat-ds:11","affected":["redhat-ds:11 (all versions)","redhat-ds:11 (all versions)","redhat-ds:12 (all versions)","redhat-ds:12 (all versions)","redhat-ds:12 (all versions)","redhat-ds:12 (all versions)","389-ds-base (all versions)","389-ds-base (all versions)","389-ds-base (all versions)","389-ds-base (all versions)","389-ds-base (all versions)","389-ds-base","389-ds-base","389-ds:1.4/389-ds-base (all versions)","389-ds-base","389-ds-base (all versions)"],"patched":["directory_server_13_2_for_rhel 10","directory_server_11_9_for_rhel 8","directory_server_13_0_eus_for_rhel 10","directory_server_11_7_e4s_for_rhel 8","directory_server_12_2_e4s_for_rhel 9","directory_server_12_4_e4s_for_rhel 9","directory_server_12_6_eus_for_rhel 9"],"published":"2026-09-07","updated":"2026-09-08","sourceUpdated":"2026-09-08T20:17:29.687","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-19843","references":[{"url":"https://access.redhat.com/errata/RHSA-2026:64768","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:64769","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:64779","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:64780","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:64782","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:64792","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:64793","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:65375","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/CVE-2026-19843","label":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515965","label":"secalert@redhat.com"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-19843.json"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-19843"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19843"}],"tags":["nvd","cve.org","exploit-available","csaf","vex","red-hat"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-09-08T14:06:40.847559Z"},"epss":0.0048,"epssPercentile":0.40548,"exploits":{"github":1,"githubRepos":["https://github.com/gduma-phData/patch-CVE-2026-19843"],"checkedAt":"2026-09-24T07:53:00.326Z"},"exploitAvailable":true,"ingestedAt":"2026-09-08T15:33:26.978Z","slug":"CVE-2026-19843","body":"## Overview\n\nA flaw was found in 389-ds-base. The Cockpit 389 Console's LDAP editor constructs an ldapsearch command by embedding an LDAP entry's distinguished name (DN) into a shell command string without proper escaping. An LDAP user with delegated privileges to create or rename directory entries could craft a malicious DN containing shell metacharacters. When a Cockpit administrator subsequently views the entry in the 389 Console, the embedded shell command executes with root privileges on the directory server host.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **RHSA-2026:64768** · Red Hat · fixed in: Red Hat Directory Server 13.2 for RHEL 10 · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:64768)\n- **RHSA-2026:64793** · Red Hat · fixed in: Red Hat Directory Server 11.9 for RHEL 8 · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:64793)\n- **RHSA-2026:64769** · Red Hat · fixed in: Red Hat Directory Server 13.0 EUS for RHEL 10 · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:64769)\n- **RHSA-2026:64792** · Red Hat · fixed in: Red Hat Directory Server 11.7 E4S for RHEL 8 · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:64792)\n- **RHSA-2026:64779** · Red Hat · fixed in: Red Hat Directory Server 12.2 E4S for RHEL 9 · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:64779)\n- **RHSA-2026:64780** · Red Hat · fixed in: Red Hat Directory Server 12.4 E4S for RHEL 9 · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:64780)\n- **RHSA-2026:64782** · Red Hat · fixed in: Red Hat Directory Server 12.6 EUS for RHEL 9 · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:64782)\n- **Red Hat VEX** · Important · affected: Red Hat Directory Server 11, Red Hat Directory Server 12, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Directory Server 11, Red Hat Directory Server 12, Red Hat Enterprise Linux 10, … · updated 2026-09-08 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-19843.json)\n- **RHSA-2026:65375** · Red Hat · fixed in: Red Hat Directory Server 12.8 for RHEL 9 · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:65375)","depth":"midnight","depthScore":58,"depthScoreParts":{"impact":46.2,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[]}