CVE-2026-19843

A flaw was found in 389-ds-base. The Cockpit 389 Console's LDAP editor constructs an ldapsearch command by embedding an LDAP entry's distinguished name (DN) into a shell command string without proper escaping. An LDAP user with delegated privileges to create or rename directory entries could craft a malicious DN containing shell metacharacters. When a Cockpit administrator subsequently views the entry in the 389 Console, the embedded shell command executes with root privileges on the directory server host.

CVSS v3 8.4 HIGH

8.4^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.7 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://access.redhat.com/errata/RHSA-2026:64768
https://access.redhat.com/errata/RHSA-2026:64769
https://access.redhat.com/errata/RHSA-2026:64779
https://access.redhat.com/errata/RHSA-2026:64780
https://access.redhat.com/errata/RHSA-2026:64782
https://access.redhat.com/errata/RHSA-2026:64792
https://access.redhat.com/errata/RHSA-2026:64793
https://access.redhat.com/errata/RHSA-2026:65375
https://access.redhat.com/security/cve/CVE-2026-19843
https://bugzilla.redhat.com/show_bug.cgi?id=2515965

Configurations

No configuration.

History

No history.

Information

Published : 2026-09-07 15:17

Updated : 2026-09-08 20:17

NVD link : CVE-2026-19843

Mitre link : CVE-2026-19843

CVE.ORG link : CVE-2026-19843

JSON object : View

Products Affected

No product.

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2026-19843", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-19843", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-09-08T14:06:40.847559Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 1.7}]}, "affected": [{"source": "secalert@redhat.com", "affectedData": [{"cpes": ["cpe:/a:redhat:directory_server_e4s:11.7::el8"], "vendor": "Red Hat", "product": "Red Hat Directory Server 11.7 E4S for RHEL 8", "versions": [{"status": "unaffected", "version": "8080020260903102346.f969626e", "lessThan": "*", "versionType": "rpm"}], "packageName": "redhat-ds:11", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:directory_server:11.9::el8"], "vendor": "Red Hat", "product": "Red Hat Directory Server 11.9 for RHEL 8", "versions": [{"status": "unaffected", "version": "8100020260904171440.37ed7c03", "lessThan": "*", "versionType": "rpm"}], "packageName": "redhat-ds:11", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:directory_server_e4s:12.2::el9"], "vendor": "Red Hat", "product": "Red Hat Directory Server 12.2 E4S for RHEL 9", "versions": [{"status": "unaffected", "version": "9020020260903155914.1674d574", "lessThan": "*", "versionType": "rpm"}], "packageName": "redhat-ds:12", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:directory_server_e4s:12.4::el9"], "vendor": "Red Hat", "product": "Red Hat Directory Server 12.4 E4S for RHEL 9", "versions": [{"status": "unaffected", "version": "9040020260903102623.1674d574", "lessThan": "*", "versionType": "rpm"}], "packageName": "redhat-ds:12", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:directory_server_eus:12.6::el9"], "vendor": "Red Hat", "product": "Red Hat Directory Server 12.6 EUS for RHEL 9", "versions": [{"status": "unaffected", "version": "9060020260903100230.1674d574", "lessThan": "*", "versionType": "rpm"}], "packageName": "redhat-ds:12", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:directory_server:12.8::el9"], "vendor": "Red Hat", "product": "Red Hat Directory Server 12.8 for RHEL 9", "versions": [{"status": "unaffected", "version": "9080020260908092641.1674d574", "lessThan": "*", "versionType": "rpm"}], "packageName": "redhat-ds:12", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:directory_server_e2s:13.0::el10"], "vendor": "Red Hat", "product": "Red Hat Directory Server 13.0 EUS for RHEL 10", "versions": [{"status": "unaffected", "version": "0:3.0.6-4.el10dsrv", "lessThan": "*", "versionType": "rpm"}], "packageName": "389-ds-base", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:directory_server:13.2::el10"], "vendor": "Red Hat", "product": "Red Hat Directory Server 13.2 for RHEL 10", "versions": [{"status": "unaffected", "version": "0:3.2.0-7.el10dsrv", "lessThan": "*", "versionType": "rpm"}], "packageName": "389-ds-base", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:directory_server:11"], "vendor": "Red Hat", "product": "Red Hat Directory Server 11", "packageName": "389-ds-base", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:directory_server:12"], "vendor": "Red Hat", "product": "Red Hat Directory Server 12", "packageName": "389-ds-base", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:10"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "packageName": "389-ds-base", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:6"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 6", "packageName": "389-ds-base", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unknown"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:7"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 7", "packageName": "389-ds-base", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:8"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", "packageName": "389-ds:1.4/389-ds-base", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:8"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", "packageName": "389-ds-base", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:9"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "packageName": "389-ds-base", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}]}], "published": "2026-09-07T15:17:31.287", "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:64768", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:64769", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:64779", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:64780", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:64782", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:64792", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:64793", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:65375", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/security/cve/CVE-2026-19843", "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515965", "source": "secalert@redhat.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "A flaw was found in 389-ds-base. The Cockpit 389 Console's LDAP editor constructs an ldapsearch command by embedding an LDAP entry's distinguished name (DN) into a shell command string without proper escaping. An LDAP user with delegated privileges to create or rename directory entries could craft a malicious DN containing shell metacharacters. When a Cockpit administrator subsequently views the entry in the 389 Console, the embedded shell command executes with root privileges on the directory server host."}], "lastModified": "2026-09-08T20:17:29.687", "sourceIdentifier": "secalert@redhat.com"}