ZeroHour

CVE-2026-76560

large1

Authorization bypass in 389 Directory Server lets anonymous clients satisfy SELFDN ACIs

CVSS 3.1
7.5 high
EPSS
<1%p30
Published
()
Modified
AI analysis

CVE-2026-76560 is an incorrect-authorization flaw (CWE-863) in the SELFDN ACI bind-rule evaluator of 389 Directory Server, the LDAP directory service shipped with Red Hat Enterprise Linux/Fedora and used as the back end of FreeIPA/Red Hat Identity Management. Because the evaluator wrongly treats an anonymous client's empty bind DN as a match for an empty stored attribute value, an unauthenticated LDAP client can satisfy SELFDN access-control rules that were intended to match a specific authenticated user's identity. A network-adjacent attacker could then perform operations such as adding or modifying directory entries that the ACI was supposed to restrict, producing integrity impacts without authentication (CVSS 3.1: 7.5, C:N/I:H/A:N). Any deployment of 389 Directory Server, including FreeIPA/IdM instances, that uses SELFDN-based ACIs and permits anonymous binds is affected. Exploitation has not been observed (EPSS ~0.4%, not in CISA KEV, no known public PoC), though related reporting describes a FreeIPA flaw chain in which anonymous clients created reusable administrator credentials.

What to do: Audit ACIs that use SELFDN/userdn bind rules, and restrict anonymous binds (e.g., set nsslapd-allow-anonymous-access to off) until the server is updated. Apply the 389 Directory Server fix from Red Hat/Fedora advisories when released — no fixed version number is stated in the available data, so check the Red Hat Security Advisory for your release. FreeIPA/IdM administrators should also watch for the related FreeIPA flaw chain that enables anonymous creation of reusable administrator credentials and review directory modifications made by anonymous bind DNs.

Affected
Red Hat / Fedora (389 Directory Server project) 389 Directory Server
Red Hat FreeIPA / Red Hat Identity Management (bundles 389 Directory Server)
Estimated exposure
largeon the order of 10,000–100,000 deployments (exact counts unknown) — 389 Directory Server is the standard LDAP server in RHEL/Fedora and the back end of FreeIPA/Red Hat IdM, so the plausible population tracks enterprise IdM/LDAP installations, though many run on internal networks and no public…

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description

A flaw was found in 389 Directory Server. The SELFDN ACI bind-rule evaluator incorrectly matches an anonymous LDAP client's empty bind DN against an empty stored attribute value, allowing an unauthenticated client to satisfy access control checks intended to require a matching authenticated identity. This can allow an anonymous LDAP client to perform an operation, such as adding or modifying a directory entry, that a SELFDN-based ACI intended to restrict to a specific authenticated user.

Weakness
CWE-863
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

In the news

FreeIPA Flaw Chain Lets Anonymous Clients Create Reusable Administrator Credentials

Critical FreeIPA flaw chain (CVE-2026-76578, CVSS 9.8) lets anonymous clients create reusable admin credentials on default installs; fixed in 4.13.4.

Red Hat warns that chaining FreeIPA's CVE-2026-76578 (CVSS 9.8) with a 389 Directory Server flaw (CVE-2026-76560, CVSS 7.5) lets an anonymous client write a Kerberos identity into the directory and land in the administrators group on default installations; Red Hat reproduced the chain twice, including on a machine with no access at all. FreeIPA 4.13.4 fixes both flaws, and fourteen 389-ds advisories shipped September 8, with RHSA-2026:64785 rated critical. A separate flaw, CVE-2026-79678 (CVSS 8.1), allows reading the server's environment variables one at a time via a Python eval() in idp-add, potentially exposing Directory Manager and administrator passwords in container installs. No real-world exploitation has been reported.