CVE-2026-76560

CVE-2026-76560 is an incorrect-authorization flaw (CWE-863) in the SELFDN ACI bind-rule evaluator of 389 Directory Server, the LDAP directory service shipped with Red Hat Enterprise Linux/Fedora and used as the back end of FreeIPA/Red Hat Identity Management. Because the evaluator wrongly treats an anonymous client's empty bind DN as a match for an empty stored attribute value, an unauthenticated LDAP client can satisfy SELFDN access-control rules that were intended to match a specific authenticated user's identity. A network-adjacent attacker could then perform operations such as adding or modifying directory entries that the ACI was supposed to restrict, producing integrity impacts without authentication (CVSS 3.1: 7.5, C:N/I:H/A:N). Any deployment of 389 Directory Server, including FreeIPA/IdM instances, that uses SELFDN-based ACIs and permits anonymous binds is affected. Exploitation has not been observed (EPSS ~0.4%, not in CISA KEV, no known public PoC), though related reporting describes a FreeIPA flaw chain in which anonymous clients created reusable administrator credentials.

What to do: Audit ACIs that use SELFDN/userdn bind rules, and restrict anonymous binds (e.g., set nsslapd-allow-anonymous-access to off) until the server is updated. Apply the 389 Directory Server fix from Red Hat/Fedora advisories when released — no fixed version number is stated in the available data, so check the Red Hat Security Advisory for your release. FreeIPA/IdM administrators should also watch for the related FreeIPA flaw chain that enables anonymous creation of reusable administrator credentials and review directory modifications made by anonymous bind DNs.