VDB

CVE-2026-19843

CVE-2026-19843 PUBLISHED CVSS 8.4 HIGH

Reported by redhat · Published September 7, 2026

A flaw was found in 389-ds-base. The Cockpit 389 Console's LDAP editor constructs an ldapsearch command by embedding an LDAP entry's distinguished name (DN) into a shell command string without proper escaping. An LDAP user with delegated privileges to create or rename directory entries could craft a malicious DN containing shell metacharacters. When a Cockpit administrator subsequently views the entry in the 389 Console, the embedded shell command executes with root privileges on the directory server host.

Risk Scores

CVSS 3.1
8.4
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

Affected Products

VendorProductVersions
Red HatRed Hat Directory Server 11.7 E4S for RHEL 88080020260903102346.f969626e
Red HatRed Hat Directory Server 11.9 for RHEL 88100020260904171440.37ed7c03
Red HatRed Hat Directory Server 12.2 E4S for RHEL 99020020260903155914.1674d574
Red HatRed Hat Directory Server 12.4 E4S for RHEL 99040020260903102623.1674d574
Red HatRed Hat Directory Server 12.6 EUS for RHEL 99060020260903100230.1674d574
Red HatRed Hat Directory Server 12.8 for RHEL 99080020260908092641.1674d574
Red HatRed Hat Directory Server 13.0 EUS for RHEL 100:3.0.6-4.el10dsrv
Red HatRed Hat Directory Server 13.2 for RHEL 100:3.2.0-7.el10dsrv
Red HatRed Hat Directory Server 11
Red HatRed Hat Directory Server 12
Red HatRed Hat Enterprise Linux 10
Red HatRed Hat Enterprise Linux 6
Red HatRed Hat Enterprise Linux 7
Red HatRed Hat Enterprise Linux 8
Red HatRed Hat Enterprise Linux 8
Red HatRed Hat Enterprise Linux 9
Red HatRed Hat Directory Server 12.6 EUS for RHEL 99060020260903100230.1674d574
Red HatRed Hat Enterprise Linux 9
Red HatRed Hat Enterprise Linux 6
Red HatRed Hat Enterprise Linux 10

…and 15 more

Timeline

  • Sep 7, 2026 CVE Published
  • Sep 8, 2026 EPSS Score
  • Sep 8, 2026 CVE Updated
  • Sep 9, 2026 EPSS Score
  • Sep 9, 2026 Distribution Patch
  • Sep 9, 2026 Distribution Patch
  • Sep 9, 2026 Distribution Patch
  • Sep 9, 2026 Distribution Patch
  • Sep 9, 2026 Distribution Patch
  • Sep 9, 2026 Distribution Patch
  • Sep 9, 2026 Distribution Patch
  • Sep 9, 2026 Distribution Patch

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›