CVE-2026-18922

389 Directory Server contains an authentication flaw (CWE-287) in its SASL handling: when a SASL PLAIN bind fails, a stale identity can remain in a Cyrus SASL auxiliary property attached to the connection. If a later, unrelated bind on that same connection succeeds — regardless of which SASL mechanism completes it — the server may install the stale identity, so an attacker who first sends a SASL PLAIN bind as cn=Directory Manager with a wrong password and then completes a SASL ANONYMOUS bind on the same connection is granted Directory Manager authority with no valid credentials; a variant using a low-privileged account's own successful bind instead of an anonymous bind is also possible. An attacker thereby gains the privileges of the stale identity, up to full Directory Manager control of the directory. Any deployment of 389 Directory Server that permits SASL PLAIN binds over reused LDAP connections is affected; specific affected version ranges are not stated in the available data, so administrators should consult the Red Hat security advisory. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known; EPSS currently estimates about a 0.6% probability of exploitation within 30 days.

What to do: Upgrade 389 Directory Server (389-ds-base) to the fixed version named in the Red Hat security advisory for your RHEL/Fedora release. Until patched, mitigate by disabling SASL PLAIN and SASL ANONYMOUS binds (or allowing anonymous binds only on dedicated connections) and by disabling SASL on directories where it is not required. Review bind logs for connections where Directory Manager-level authority was granted after an anonymous bind or an unrelated successful bind, and check whether clients reuse a single LDAP connection across multiple binds.