Skip to main content
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Reach LDAP service over network
  2. Delivery
    Send CleanAllRUV status-check extended op
  3. Exploit
    Inject crafted filter into cn=config search
  4. Execution
    Observe boolean match oracle
  5. Persist
    Iterate to extract bind DNs and password scheme
  6. Impact
    Reuse metadata for credential attack

Vulnerability Assessment

Weakness
CWE
CWE-90
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization LDAP query parameterization
MITRE ATT&CK

1 technique across 1 tactic: Initial Access

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires that the target expose the LDAP service and honor the CleanAllRUV replication status-check extended operation to unauthenticated clients - i.e., a 389 Directory Server or Red Hat Directory Server instance with the multi-master replication (replication plugin) subsystem present and network-reachable. Per CVSS AV:N/AC:L/PR:N/UI:N, no credentials, user interaction, or special client privileges are needed against such an instance. Limiting factors: the attacker must reach the LDAP port (network segmentation or firewalling that blocks the extended operation prevents it), the impact is confined to configuration metadata exposed via a boolean oracle rather than arbitrary data reads, and extraction is incremental and boolean-blind, making it slower and more detectable than a direct read. Deployments that do not use replication or that restrict extended operations to trusted peers materially reduce exposure.
Impact

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N scores 7.5 and is internally consistent with the description: fully remote, low complexity, no privileges or user interaction, pure confidentiality impact with no integrity or availability effect. No EPSS score, KEV entry, or SSVC decision data was provided, so exploitation probability cannot be quantified from the input, and no public proof-of-concept was referenced. The realistic impact is narrower than raw confidentiality-High suggests: this is a blind boolean oracle that leaks configuration metadata (bind DNs, password storage scheme), not full data exfiltration or directory dumping, and exploiting a boolean oracle can be slow and noisy. Net assessment: a genuine unauthenticated information-disclosure and reconnaissance issue worth prioritized patching on internet- or partner-facing directory servers, but the absence of active-exploitation and POC signals places it below wormable or RCE-class emergencies.
Exploit ScenarioDerived

An unauthenticated attacker with network access to the LDAP service sends a series of crafted CleanAllRUV replication status-check extended operations, each embedding an injected LDAP filter fragment targeting cn=config. By observing whether each request returns a boolean match, the attacker infers replication bind DNs and the configured password storage scheme character by character, building an accurate picture of the directory's internal configuration for follow-on credential attacks. No public POC was referenced, but the low attack complexity makes scripting the oracle straightforward.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
No patch listed yet 0.5% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 31, 2026

Information disclosure in 389 Directory Server (upstream of Red Hat Directory Server 11-13, shipped across RHEL 6-10) lets an unauthenticated remote attacker inject LDAP search filters into the CleanAllRUV replication status-check extended operation. Because the handler evaluates attacker-controlled filters against cn=config using elevated replication-plugin privileges and leaks a boolean match result, attackers can blindly enumerate sensitive configuration metadata such as replication bind DNs and password storage scheme details. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, no-authentication attack surface makes it a meaningful reconnaissance primitive.

RemediationAI

No vendor-released patch version is identified in the available data, so the primary action is to monitor and apply the Red Hat errata referenced at https://access.redhat.com/security/cve/CVE-2026-11770 and bug https://bugzilla.redhat.com/show_bug.cgi?id=2484802, then update the 389-ds-base and redhat-ds packages to the fixed version once published. As compensating controls until patched: restrict network reachability of LDAP ports 389 and 636 so only trusted replication peers and management hosts can send extended operations via host firewall or network segmentation, accepting that this constrains legitimate remote administration; place the directory behind a filtering LDAP proxy or load balancer that can block or rate-limit the CleanAllRUV extended-operation OID, noting this may interfere with legitimate replication maintenance; and rotate replication bind DN credentials and review the password storage scheme configuration after patching in case metadata was already probed. Increase auditing and logging on extended-operation activity to detect oracle-style brute forcing.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

389 Directory Server is an open-source LDAP directory server that underpins Red Hat Directory Server and Red Hat Identity Management (FreeIPA). CleanAllRUV is a multi-master replication maintenance task used to purge obsolete Replica Update Vector (RUV) entries; its status is queried through an LDAP extended operation handled in ldap/servers/plugins/replication/repl_extop.c. The root cause is CWE-90 (LDAP Injection): user-supplied input is concatenated into an LDAP search filter without neutralizing filter metacharacters, and that filter is executed against the cn=config subtree with the replication plugin's elevated internal privileges. Because the operation returns a boolean match/no-match indication, the injected filter acts as a blind oracle, allowing character-by-character inference of configuration attribute values that a remote, unauthenticated client should never be able to read.

Know when LDAP gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (redhat) PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
vuln.today AI 7.5 HIGH

Remote, no auth or interaction, low complexity; boolean-blind leak of sensitive config metadata yields C:H with no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
SUSE HIGH
Red Hat 7.5 MEDIUM

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

DescriptionCVE.org

A flaw was found in 389 Directory Server. An unauthenticated remote attacker can inject LDAP search filters into the CleanAllRUV replication status-check extended operation. Because the handler performs the search against cn=config with elevated replication plugin privileges and returns a boolean match result, the attacker can extract sensitive server configuration metadata, including replication bind DNs and password storage scheme information.

Executive ViewAI

Why It Matters

Red Hat Directory Server versions 11-13 and RHEL 6-10 systems are vulnerable to unauthenticated remote information disclosure attacks that allow attackers to extract sensitive directory configuration including replication passwords and authentication settings without authentication. This reconnaissance capability creates a direct staging point for coordinated attacks on identity infrastructure. Immediate network isolation is required while awaiting vendor remediation.

Business Impact: High
Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: restrict network access to Directory Server instances via firewall rules blocking LDAP ports 389/636 from untrusted networks, implement ACLs to disable or restrict the CleanAllRUV extended operation, enable and monitor LDAP query audit logs for anomalous filter patterns indicating reconnaissance attempts, and consider implementing LDAP request rate-limiting on the extended operation handler.

Threat Intelligence Overview

EPSS Score
0.5%
Top 60% exploitable
Prevalence
Medium
enterprise LDAP directory common in Red Hat IdM and RHEL environments, not ubiquitous
Social Media
2
Sightings
Data Quality
8 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor CIRCL GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.5%
Patch available No
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact
High
Technical Impact
Partial

Priority Score

39
Low Medium High Critical
KEV: 0
EPSS: +1
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Code Injection CRITICAL

Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.

Affected Products (CPE)CVE.org

cpe:2.3:a:red_hat:red_hat_directory_server_11:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_directory_server_12:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_directory_server_13:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_10:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_6:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_7:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_8:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_9:*:*:*:*:*:*:*:*

More in LDAP

View all
CVE-2016-9299 CRITICAL POC
9.8 Jan 12

The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers to execute arbitrary code via a
CVE-2017-14596 CRITICAL POC
9.8 Sep 20

In Joomla!. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required,

CVE-2017-8790 CRITICAL POC
9.8 May 05

An issue was discovered on Accellion FTA devices before FTA_9_12_180. Rated critical severity (CVSS 9.8), this vulnerabi
CVE-2026-15723 HIGH POC
8.2 Oct 21

An authenticated GitLab user can seize control of an existing LDAP-backed account on instances that have both OmniAuth S
CVE-2026-11748 MEDIUM POC
6.9 Jun 22

LDAP injection in Central Dogma's Apache Shiro-based authentication module exposes unauthenticated remote attackers to a
CVE-2023-28853 MEDIUM POC
6.5 Apr 04

Mastodon is a free, open-source social network server based on ActivityPub Mastodon allows configuration of LDAP for aut
CVE-2020-36966 MEDIUM POC
6.4 Jan 30

Dolibarr 11.0.3 contains a persistent cross-site scripting vulnerability in LDAP synchronization settings that allows at
CVE-2025-36556 MEDIUM POC
6.1 Jan 20

A reflected cross-site scripting (xss) vulnerability exists in the ldapUser functionality of MedDream PACS Premium 7.3.6
CVE-2026-23906 CRITICAL
9.8 Feb 10

Authentication bypass in Apache Druid versions 0.17.0 through 35.x. Affects all versions prior to 36.0.0 when specific p
CVE-2026-44930 CRITICAL
9.8 May 22

Arbitrary certificate disclosure in Apache CXF's XKMS server lets remote attackers abuse an LDAP injection flaw (CWE-90)
CVE-2024-33868 CRITICAL
9.8 May 14

An issue was discovered in linqi before 1.4.0.1 on Windows. Rated critical severity (CVSS 9.8), this vulnerability is re
CVE-2023-6905 CRITICAL
9.8 Dec 18

A vulnerability, which was classified as problematic, has been found in Jahastech NxFilter 4.3.2.5.jsp?actionFlag=test&i

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Server Applications 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Server 16.0 Affected
SUSE Linux Enterprise Server 16.1 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-11770 ADVISORY https://vuldb.com/vuln/385062 REF https://access.redhat.com/errata/RHSA-2026:55421 REF https://access.redhat.com/errata/RHSA-2026:55422 REF https://access.redhat.com/errata/RHSA-2026:55423 REF https://access.redhat.com/errata/RHSA-2026:55424 REF https://access.redhat.com/errata/RHSA-2026:55425 REF https://access.redhat.com/errata/RHSA-2026:55426 REF https://access.redhat.com/errata/RHSA-2026:55530 REF https://access.redhat.com/errata/RHSA-2026:55532 REF https://access.redhat.com/errata/RHSA-2026:55756 REF https://access.redhat.com/errata/RHSA-2026:55757 REF https://access.redhat.com/errata/RHSA-2026:55758 REF https://access.redhat.com/errata/RHSA-2026:55794 REF https://access.redhat.com/errata/RHSA-2026:56047 REF https://access.redhat.com/errata/RHSA-2026:56048 REF https://access.redhat.com/errata/RHSA-2026:56050 REF https://access.redhat.com/errata/RHSA-2026:79217 REF https://access.redhat.com/security/cve/CVE-2026-11770 REF https://bugzilla.redhat.com/show_bug.cgi?id=2484802 REF https://github.com/389ds/389-ds-base/blob/main/ldap/servers/plugins/replication/repl_extop.c

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy