CVE-2026-14969 Red Hat CVE debrief

Who should care

Users of 389-ds-base, particularly those with privileged filesystem access, should review their configurations and ensure that appropriate mitigations are in place. This includes reviewing encryption practices and considering upgrades to a version of 389-ds-base that addresses this vulnerability.

Technical summary

The LDBM backend attribute encryption in 389-ds-base uses a hardcoded static initialization vector for AES-CBC and 3DES-CBC operations. This vulnerability allows an attacker with privileged filesystem access to detect plaintext equality across encrypted entries by comparing ciphertext blocks. Affected 389-ds-base deployments should be reviewed to ensure secure encryption practices are in place, including reviewing configurations and considering upgrades to a version that addresses this vulnerability. Additionally, defenders should verify the official CVE record and NVD entry for the most up-to-date information and review the Red Hat security advisory and Bugzilla entry for further details.

Defensive priority

Medium priority due to the requirement for privileged filesystem access.

Recommended defensive actions

• Review 389-ds-base configurations to ensure secure encryption practices are in place.
• Implement additional monitoring for filesystem access patterns.
• Consider upgrading to a version of 389-ds-base that addresses this vulnerability.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record was published on 2026-07-07T16:16:38.310Z and has not been modified since then. The NVD entry is currently Received. There is limited evidence available to confirm affected scope and severity. Defenders should verify the official CVE record and NVD entry for the most up-to-date information. Additionally, review the Red Hat security advisory and Bugzilla entry for further details.

Official resources