389 Directory Server CVE-2026-19404

Unauthenticated exploitation requires that nsslapd-allow-anonymous-access is set to on, which is the default configuration for 389 Directory Server - no special setup is needed beyond a standard installation. If anonymous access has been disabled (a hardening step not applied by default), exploitation still requires only a valid LDAP bind with any low-privilege account; no elevated permissions, administrative role, or special group membership is needed for the authenticated path. The affected operations (CleanAllRUV / Abort CleanAllRUV) must be reachable - i.e., the LDAP port must be accessible to the attacker, which limits internet-exposed risk but does not protect against insider or network-adjacent threat actors. There is no requirement for a specific suffix, replica topology configuration, or running replication task; the authorization gap exists regardless of whether active replication is configured.

The CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) accurately reflects a network-reachable, low-complexity flaw requiring no authentication under the default configuration. The integrity and availability impacts are both rated Low, which understates the operational consequence in multi-master replication topologies - forced removal of a replica ID or purging of changelog records can cause replication inconsistency that requires manual intervention to resolve, potentially affecting all consumers of the directory. There is no EPSS score or CISA KEV listing available in the provided data, and no public proof-of-concept has been identified, which lowers immediate urgency; however, the trivial exploit path (a single crafted LDAP extended operation) means that once the flaw is publicly understood, exploitation is highly automatable. Even a mid-sized municipal IT team in mielec operating a Red Hat IdM or FreeIPA deployment built on this server should treat this as a meaningful operational risk, particularly since anonymous LDAP access is the default state. The partial mitigation - disabling anonymous access raises the bar to any authenticated low-privilege user, which is still a very low barrier in environments with broad directory read access. No conflicting signals exist between the CVSS vector and the description; both are internally consistent.

An unauthenticated attacker with network access to the LDAP port (389/tcp) on a server running the default configuration constructs and sends a single LDAP ExtendedRequest PDU bearing the CleanAllRUV or Abort CleanAllRUV OID, requiring no bind or credentials. The directory server processes the operation without any authorization check, removes the targeted replica ID from the RUV, and purges associated changelog records, breaking multi-master replication for that replica and forcing administrator intervention to restore consistent state. No public exploit code has been identified, but the operation requires only standard LDAP tooling (ldapextop or equivalent) and is trivially reproducible by anyone with knowledge of the OID.