Skip to content
Advisories.
Red HatCVE-2026-76560

Red Hat 389 Directory Server: improper access control

High7.5CVE-2026-76560 · Published Sep 7, 2026 · updated Sep 8, 2026

A flaw was found in 389 Directory Server. The SELFDN ACI bind-rule evaluator incorrectly matches an anonymous LDAP client's empty bind DN against an empty stored attribute value, allowing an unauthenticated client to satisfy access control checks intended to require a matching authenticated identity. This can allow an anonymous LDAP client to perform an operation, such as adding or modifying a directory entry, that a SELFDN-based ACI intended to restrict to a specific authenticated user.

Red Hat advisory

Affected versions

The source does not list versions here. See the source advisory for affected products and fixes.
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-863

More Red Hat advisories

All Red Hat
Advisory
Red Hat GLib2.: link following
Medium5.3Sep 7
Red Hat 389 Directory Server: denial of service
High7.5Sep 7
Red Hat 389 Directory Server: improper authentication
Critical9.8Sep 7
Red Hat 389-ds-base. The Cockpit 389 Console: command injection
High8.4Sep 7
Red Hat: buffer overflow
High7.5Sep 7
Red Hat FreeIPA: improper access control
High8.1Sep 7

Critical advisories by email

Wednesdays: the week’s critical and high advisories in the AI and data stack, with the fixed versions. Only in weeks that have some.

Double opt-in. Unsubscribe any time.