Authorization bypass in 389 Directory Server lets anonymous clients satisfy SELFDN ACIs
AI analysis
CVE-2026-76560 is an incorrect-authorization flaw (CWE-863) in the SELFDN ACI bind-rule evaluator of 389 Directory Server, the LDAP directory service shipped with Red Hat Enterprise Linux/Fedora and used as the back end of FreeIPA/Red Hat Identity Management. Because the evaluator wrongly treats an anonymous client's empty bind DN as a match for an empty stored attribute value, an unauthenticated LDAP client can satisfy SELFDN access-control rules that were intended to match a specific authenticated user's identity. A network-adjacent attacker could then perform operations such as adding or modifying directory entries that the ACI was supposed to restrict, producing integrity impacts without authentication (CVSS 3.1: 7.5, C:N/I:H/A:N). Any deployment of 389 Directory Server, including FreeIPA/IdM instances, that uses SELFDN-based ACIs and permits anonymous binds is affected. Exploitation has not been observed (EPSS ~0.4%, not in CISA KEV, no known public PoC), though related reporting describes a FreeIPA flaw chain in which anonymous clients created reusable administrator credentials.
What to do: Audit ACIs that use SELFDN/userdn bind rules, and restrict anonymous binds (e.g., set nsslapd-allow-anonymous-access to off) until the server is updated. Apply the 389 Directory Server fix from Red Hat/Fedora advisories when released — no fixed version number is stated in the available data, so check the Red Hat Security Advisory for your release. FreeIPA/IdM administrators should also watch for the related FreeIPA flaw chain that enables anonymous creation of reusable administrator credentials and review directory modifications made by anonymous bind DNs.
Affected
| Red Hat / Fedora (389 Directory Server project) 389 Directory Server | — |
| Red Hat FreeIPA / Red Hat Identity Management (bundles 389 Directory Server) | — |
Estimated exposure
largeon the order of 10,000–100,000 deployments (exact counts unknown) — 389 Directory Server is the standard LDAP server in RHEL/Fedora and the back end of FreeIPA/Red Hat IdM, so the plausible population tracks enterprise IdM/LDAP installations, though many run on internal networks and no public…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
A flaw was found in 389 Directory Server. The SELFDN ACI bind-rule evaluator incorrectly matches an anonymous LDAP client's empty bind DN against an empty stored attribute value, allowing an unauthenticated client to satisfy access control checks intended to require a matching authenticated identity. This can allow an anonymous LDAP client to perform an operation, such as adding or modifying a directory entry, that a SELFDN-based ACI intended to restrict to a specific authenticated user.