CVE-2026-19843 Red Hat CVE debrief

Who should care

System administrators and security teams responsible for managing 389-ds-base and LDAP users should assess exposure and prioritize mitigation. This includes reviewing system configurations, verifying affected versions, and applying patches or workarounds as needed. Additionally, security teams should monitor LDAP user activity and 389 Console usage for potential suspicious behavior, and consider implementing compensating controls for exposed systems.

Why it matters

CVE-2026-19843 allows LDAP users with delegated privileges to execute shell commands with root privileges on the directory server host, requiring immediate attention from system administrators and security teams.

• Potential execution of arbitrary shell commands with root privileges on the directory server host.
• Possible elevation of privileges for LDAP users with delegated privileges.
• Required verification of affected versions and remediation efforts.
• Necessity to monitor and restrict LDAP user activity.

Technical summary

The Cockpit 389 Console's LDAP editor constructs an ldapsearch command by embedding an LDAP entry's distinguished name (DN) into a shell command string without proper escaping. An LDAP user with delegated privileges to create or rename directory entries could craft a malicious DN containing shell metacharacters. When a Cockpit administrator subsequently views the entry in the 389 Console, the embedded shell command executes with root privileges on the directory server host. This vulnerability highlights the importance of proper input validation and escaping in command strings.

Defensive priority

Defenders should prioritize verifying and mitigating this vulnerability, especially in environments where LDAP users have delegated privileges.

Recommended defensive actions

• Verify and apply the security updates provided by Red Hat for 389-ds-base.
• Restrict LDAP user privileges to minimize the attack surface.
• Monitor LDAP user activity and 389 Console usage for suspicious behavior.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD detail page provide information on the vulnerability, including its description, CVSS score, and affected products. However, the details are limited, and further verification is required to understand the full scope of the vulnerability. Defenders should verify the affected versions of 389-ds-base and review the Red Hat errata for specific patches. The lack of detailed information on exploitation in the wild or known attacks highlights the need for proactive measures.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.