What happened
A critical vulnerability, identified as CVE-2026-86345, has been disclosed in the 389-ds-base software. The flaw stems from the server not discarding plaintext bytes buffered from a client connection during StartTLS negotiations. This flaw can be exploited by an on-path attacker to inject a crafted LDAP message that, after the TLS upgrade, is processed instead of the client’s original message. Due to messageID collision, the server might deliver a response related to the attacker’s malicious message, potentially causing the client application to misinterpret a failed authentication attempt as successful. This could lead to unauthorized privilege escalation under certain conditions.
Who is affected
Organisations running Red Hat Directory Server versions 11, 12, or 13, as well as those operating affected deployments on Red Hat Enterprise Linux versions 6 through 10, may be vulnerable to this flaw. The vulnerability permits remote attackers to target exposed LDAP services directly over a network without prior access or user interaction, provided the specific conditions for the attack are met. The severity score of 9.0 under CVSS 3.1 indicates a high level of risk with significant potential impact on affected systems.
Recommended actions
- Protect exposed LDAP services by limiting network access through proper segmentation and access controls to reduce the attack surface.
- Ensure LDAP services are not directly accessible from untrusted networks where possible.
- Monitor network traffic for unusual activity that may indicate injection or manipulation of LDAP messages.
- Apply security patches or updates when they become available from the software provider or vendor that address this vulnerability, once released.
Indicators of compromise
At present, specific indicators of compromise related to this vulnerability are not publicly available. Monitoring for anomalies in LDAP traffic and failed or unexpected LDAP responses may aid in early detection of potential exploitation attempts.
