CVE-2026-11770 — HIGH (7.5)

Vulnerability Description

A flaw was found in 389 Directory Server. An unauthenticated remote attacker can inject LDAP search filters into the CleanAllRUV replication status-check extended operation. Because the handler performs the search against cn=config with elevated replication plugin privileges and returns a boolean match result, the attacker can extract sensitive server configuration metadata, including replication bind DNs and password storage scheme information.

CVSS Score

7.5

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

NONE

Availability

NONE

Affected Products

Vendor	Product	Versions
Redhat	Directory Server	11.0
Redhat	389 Directory Server	-
Redhat	Enterprise Linux	7.0

Related Weaknesses (CWE)

CWE-90

References

https://access.redhat.com/security/cve/CVE-2026-11770Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2484802Issue TrackingVendor Advisory
https://github.com/389ds/389-ds-base/blob/main/ldap/servers/plugins/replication/Product

FAQ

What is CVE-2026-11770?

CVE-2026-11770 is a vulnerability with a CVSS score of 7.5 (HIGH). A flaw was found in 389 Directory Server. An unauthenticated remote attacker can inject LDAP search filters into the CleanAllRUV replication status-check extended operation. Because the handler perfor...

How severe is CVE-2026-11770?

CVE-2026-11770 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-11770?

Check the references section above for vendor advisories and patch information. Affected products include: Redhat Directory Server, Redhat 389 Directory Server, Redhat Enterprise Linux.