CVE-2026-11770: redhat 389_directory_server LDAP Injection

Vulnerability summary

CVE-2026-11770 is a high (CVSS 7.5) LDAP Injection vulnerability in redhat 389_directory_server. EPSS estimates a 0.53% chance of exploitation in the next 30 days, higher than 43.4% of scored vulnerabilities.

Timeline

1. 31-07-2026
   PublishedVulnerability first disclosed.
2. 08-10-2026
   Last modifiedVulnerability information updated.

Description

A flaw was found in 389 Directory Server. An unauthenticated remote attacker can inject LDAP search filters into the CleanAllRUV replication status-check extended operation. Because the handler performs the search against cn=config with elevated replication plugin privileges and returns a boolean match result, the attacker can extract sensitive server configuration metadata, including replication bind DNs and password storage scheme information.

• CWE-90Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')The product constructs all or part of an LDAP query using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended LDAP query when it is sent to a downstream component.