CVE-2026-19843

389-ds-base contains an OS command injection flaw (CWE-78) in the LDAP editor of its Cockpit 389 web console: the console builds an ldapsearch command by inserting an LDAP entry's distinguished name (DN) directly into a shell command string without escaping. An LDAP user who has been delegated privileges to create or rename directory entries can plant a DN containing shell metacharacters; when a Cockpit administrator later views that entry in the 389 Console, the injected shell command executes. The injected command runs with root privileges on the directory server host, so a semi-trusted delegated LDAP user can achieve full root-level compromise of that host (scope-changed, high confidentiality/integrity/availability impact). Organizations running 389-ds-base — the LDAP directory server assigned by Red Hat and shipped in Red Hat and Fedora environments — whose administrators use the Cockpit 389 Console's LDAP editor are affected. There is no known public proof-of-concept, the issue is not in CISA's KEV catalog, and EPSS estimates only a 0.5% chance of exploitation within 30 days (40th percentile), indicating no known exploitation at this time.

What to do: Track and apply the Red Hat security advisory update for 389-ds-base when released (no fixed version numbers are available in the data provided). As interim mitigation, avoid the LDAP editor in the Cockpit 389 Console for now, limit delegated entry-create/rename privileges to fully trusted users, and audit existing DNs for shell metacharacters; also restrict Cockpit access on directory server hosts. Check whether any delegated LDAP users have recently created or renamed entries with unusual DNs, since such entries could carry pre-planted commands.