389-ds-base CVE-2026-14969

Exploitation requires the following specific conditions: (1) the attacker must have privileged local filesystem access to the LDBM database directory - consistent with the CVSS AV:L/PR:H vector, this means root-level or equivalent OS access to the host running 389-ds-base; (2) the 389-ds-base instance must be configured with attribute-level encryption enabled on one or more attributes using AES-CBC or 3DES-CBC - this is a non-default configuration that must be explicitly activated by a directory administrator; (3) the target attributes must store values where equality is meaningful (e.g., hashed credentials, unique identifiers, PII fields). Exploitation is limited by: the requirement for pre-existing privileged OS access (meaning the host is already compromised); the non-default nature of LDBM attribute encryption (only organizations that specifically opted into this feature are affected); and the passive nature of the attack (no code execution, no network path, no user interaction required). The attacker cannot recover plaintext values - only detect that two ciphertexts represent the same underlying plaintext.

The CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) scores 4.4 Medium, and the vector is internally consistent with the described attack: local access (AV:L) with high privileges (PR:H) is required to read raw LDBM database files, which are normally restricted to the directory server process and root. The C:H rating reflects the potential sensitivity of encrypted attributes (identity data, credentials, PII) and the fact that equality detection across entries can constitute a meaningful confidentiality breach in high-assurance deployments. No EPSS score was provided in the input data; given the high privilege bar and the passive, non-exploitable nature of the flaw (no code execution path), real-world exploitation probability is expected to be very low in practice. The CVE is not in the CISA KEV catalog, and no POC or active exploitation evidence has been provided. The primary real-world risk is insider threat or post-compromise forensic analysis: an attacker who has already achieved root on the RHEL host could leverage this to correlate directory entries without triggering authentication-layer auditing. For most organizations, the exploit precondition (privileged filesystem access) represents a breach condition already - this vulnerability adds incremental exposure beyond that baseline rather than enabling initial access.

An attacker who has escalated to root on a RHEL host running Red Hat Directory Server opens the LDBM database files directly (e.g., using a Berkeley DB tool or raw file reads on /var/lib/dirsrv/slapd-instance/db/) and extracts the raw ciphertext bytes for an encrypted attribute such as a personal identifier or credential field across multiple user entries. Because the static IV causes identical plaintext values to encrypt to identical ciphertext, the attacker can group entries by ciphertext equality - for example, confirming which users share the same attribute value - without needing the encryption key or recovering any actual plaintext. No public proof-of-concept code has been identified at time of analysis.