CVE-2026-19404 Red Hat CVE debrief

Who should care

System administrators and security teams managing 389 Directory Server instances, especially those with nsslapd-allow-anonymous-access enabled, should be aware of this vulnerability and take defensive actions to restrict access to sensitive operations. Affected operators should review system configurations and verify potential exposure. Vulnerability management and security teams should prioritize patching and monitor for potential replication inconsistencies.

Technical summary

The CleanAllRUV and Abort CleanAllRUV replication-maintenance extended operations in 389 Directory Server perform no authorization check. This allows an unauthenticated remote attacker to invoke them when nsslapd-allow-anonymous-access is enabled, or any authenticated low-privilege user to invoke them otherwise. This can lead to removal of a replica ID from replication metadata, purging of changelog records, and interruption of administrator-initiated cleanup, potentially leaving replication inconsistent or unavailable.

Defensive priority

Medium-priority defensive actions are required to address CVE-2026-19404, focusing on restricting access to sensitive operations.

Recommended defensive actions

• Restrict access to replication-maintenance extended operations
• Verify and limit the use of nsslapd-allow-anonymous-access
• Monitor for and respond to potential replication inconsistencies
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The evidence provided is limited, based on CVE and NVD records. Verify affected scope and vendor guidance with official advisories. Confirm potential exposure by reviewing system configurations, especially where nsslapd-allow-anonymous-access is enabled. Monitor for and respond to potential replication inconsistencies. Defensive verification tasks are required due to evidence limits.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.