CVE-2026-19843 Red Hat CVE debrief

Who should care

Defenders and administrators responsible for LDAP directory management and Cockpit 389 Console should assess exposure and prioritize mitigation. This includes reviewing the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. They should also plan vendor-supported updates or mitigations through normal change control where exposure is confirmed and review compensating controls for exposed systems while

Why it matters

CVE-2026-19843 is a high-severity vulnerability in 389-ds-base that allows an LDAP user to craft a malicious DN containing shell metacharacters, potentially leading to shell injection and command execution with root privileges. Defenders and administrators responsible for LDAP directory management and Cockpit 389 Console should assess exposure and prioritize mitigation.

• Potential for shell injection and command execution with root privileges
• Possible lateral movement and escalation of privileges
• Need for verification of affected versions and remediation
• Importance of monitoring LDAP directory entries for suspicious activity

Technical summary

The Cockpit 389 Console's LDAP editor constructs an ldapsearch command by embedding an LDAP entry's distinguished name (DN) into a shell command string without proper escaping. An LDAP user with delegated privileges to create or rename directory entries could craft a malicious DN containing shell metacharacters. This allows the LDAP user to potentially execute shell commands with root privileges on the directory server host when a Cockpit administrator views the entry in the 389 Console. The vulnerability is a result of

Defensive priority

Defenders should prioritize verifying and mitigating this vulnerability, especially in environments where LDAP users have delegated privileges.

Recommended defensive actions

• Verify and apply patches or updates from the vendor
• Restrict LDAP user privileges to minimize potential impact
• Monitor LDAP directory entries for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details about the vulnerability, but additional information from the vendor and other sources may be necessary to fully understand the impact and mitigation. The vulnerability is caused by the Cockpit 389 Console's LDAP editor constructing an ldapsearch command by embedding an LDAP entry's distinguished name (DN) into a shell command string without proper escaping. This allows an LDAP user with delegated privileges to create or rename directory entries to craft a malicious DN containing shell met

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.