CVE-2026-76560 Red Hat CVE debrief

Who should care

System administrators and security teams responsible for 389 Directory Server deployments should assess exposure and verify authentication and access control configurations to mitigate this vulnerability. They should also review and update SELFDN ACI bind-rule evaluator settings, monitor directory entry modifications for unauthorized changes, and implement compensating controls for exposed systems.

Why it matters

CVE-2026-76560 allows an unauthenticated client to bypass access control checks in 389 Directory Server, potentially leading to unauthorized directory entry modifications. System administrators and security teams should verify authentication and access control configurations to mitigate this vulnerability.

• Potential unauthorized directory entry modifications
• Bypass of access control checks
• Increased risk of data tampering
• Need for verification of authentication and access control configurations

Technical summary

The SELFDN ACI bind-rule evaluator in 389 Directory Server incorrectly matches an anonymous LDAP client's empty bind DN against an empty stored attribute value. This allows an unauthenticated client to satisfy access control checks intended to require a matching authenticated identity, potentially leading to unauthorized directory entry modifications. The vulnerability affects 389 Directory Server deployments, and defenders should focus on verifying authentication and access control configurations to mitigate this vulnerability.

Defensive priority

High priority for authentication and access control verification

Recommended defensive actions

• Verify authentication and access control configurations for 389 Directory Server
• Review and update SELFDN ACI bind-rule evaluator settings
• Monitor directory entry modifications for unauthorized changes
• Perform vulnerability assessment to identify potential exposure
• Implement compensating controls for exposed systems
• Review asset inventory for affected product deployments
• Track exceptions and retest remediated assets

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but specific version information and remediation steps require verification from official sources. The SELFDN ACI bind-rule evaluator in 389 Directory Server incorrectly matches an anonymous LDAP client's empty bind DN against an empty stored attribute value, allowing an unauthenticated client to satisfy access control checks intended to require a matching authenticated identity. Evidence limits and source grounding indicate that defenders should verify authentication,

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.